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Preface 


End of Certainty 


The great success of classical physics and the closely related engineering 
mechanics, such as the precision of Kepler’s laws verified by Tycho Brahe’s data, 
has trapped us in deterministic thinking: although engineers deal with data uncer- 
tainty. In practice, we see little quantification of model uncertainty or even mas- 
tering structural uncertainty in design and usage of technical systems today. 

In this book, we fully recognise “The End of Certainty” as Prigogine puts it’ in 
socio-technical systems. The ratio, but also the intuition of engineers, is based on 
reliable data and a reliable imagination of the relevant reality. The design of safe 
and sustainable systems needs exploring the complete design space and not only a 
small step into it. It needs a holistic view starting from the resources or component 
and ending at the socio-technical systems and their evolution in time. 

This insight and the primacy of safety and sustainability including costs, energy 
and material consumption force us to master uncertainty and especially ignorance as 
the most important manifestation of uncertainty. Safety and sustainability are the 
main objectives in solving the unknown-unknowns: mastering uncertainty is one of 
today’s fundamental methodological, technological, economic and sociologic tasks 
for science, industry and society. This contributes to coining the current paradigm 
of science. 

“Science finds, industry applies, man adapts” is an outdated paradigm. Today, it 
is replaced either by Responsible Research and Innovation (RRI) or even Open 
Science.” Therefore, the question whether “science push” or “society pull” is ade- 
quate, is in fact answered by agreeing on the latter with broad consent of most 
scientists. Considering engineering design and engineering science, “society pull” 
has always been the motivation, as solving social needs sustainably is the task of any 


'Prigogine, I., Stengers, I.: The End of Certainty: Time’s Flow and the Laws of Nature. Free Press, 
New York (1997). 


7A Century of Progress: Official Guide—Book of the Fair, 1933. A Century of Progress, Chicago 
(1933). 


3Nordmann, A.: Vorlesung Ingenieurwissenschaft und Gesellschaft, TU Darmstadt (2019). 
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engineering work. This book contributes to this task by presenting innovative 
methods, technologies and strategies for mastering uncertainty in technical systems. 


Story Behind This Book 


In 2007 a group of six engineers and mathematicians, Reiner Anderl, Herbert 
Birkhofer, Peter Groche, Holger Hanselka, Alexander Martin and Stefan Ulbrich, 
all members of Technische Universitat Darmstadt at that time, recognised that 
uncertainty often propagates un-managed through the product life cycle. Even 
though tolerance synthesis and, already at that time, uncertainty quantification was 
a large field of science, it was recognised that a holistic strategy to master uncer- 
tainty throughout the product life cycle was missing. In other words, mastering 
uncertainty in the synthesis and usage was identified to have a much broader 
implication than quantification of uncertainty in the phases of the product life cycle. 
In fact, mastering uncertainty includes uncertainty quantification. 

From the year 1950 on, Genichi Taguchi pioneered in mastering uncertainty by 
establishing his Robust Design methodology using applied mathematical methods, 
such as stochastics and optimisation applied to the design and production process. 
Thus, right from the beginning, it was obvious that expertise from engineering and 
applied mathematics needed to be combined. The cooperation of engineers and 
mathematicians has proven to be most fruitful for both sides. In the recent research 
phase since the year 2016, perspectives from law, history and linguistics, which are 
all present in this book, contributed to mastering uncertainty. 

From January 2009 till March 2021 research on the topic “Mastering 
Uncertainty in Mechanical Engineering” has been conducted. Throughout, more 
than twelve research groups from the faculty of mechanical engineering, mathe- 
matics, law, linguistics and history collaborated. All involved researchers are 
indicated following this preface. They sum up to an impressive number of nearly 
100 researchers. In addition, there are many students guided by those researchers 
who have dealt with the main topic of this book in their research work. All test rigs 
and mechatronic systems that serve as demonstrators to validate the findings of this 
book, such as the Modular Active Spring-Damper System, the Active Air Spring 
and the 3D Servo Press, were built in the workshops of the research groups. By that 
more than 20 workshop employees of Technische Universitat Darmstadt supported 
the research work. 

During this long period of time, the research has been continuously funded by 
the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation)— 
project number 57157498—Sonderforschungsbereich (SFB, Collaborative 
Research Centre) 805. We all are grateful to the colleagues from other German 
universities for their support and interest. They served as reviewers in three main 
review sessions and two further research sessions at the very beginning of the 
project, as well as at the very end of the project. We would further like to thank the 
DFG for funding our research, namely Ursula von Gliscynski, Wieland Biedermann 
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and Ferdinand Hollmann for their interest and support. They accompanied the 
research during that long period. 


Openness, Friction, Intellectual Environment 


A funded research group of up to 100 researchers, Principal Investigators (PI) and 
students, is a not to be overseen structure within any university. The SFB 805 
“Mastering Uncertainty in load-bearing Systems of Mechanical Engineering” 
emerged from a discussion of six colleagues. As such, it is a typical example of 
bottom-up research. In an analogon to non-linear thermodynamics the structure may 
be called a dissipative structure. As it may be known, the prerequisites for its 
formation are, first, an open system boundary and, second, friction. For a university 
with a technical background, such as the Technische Universitat Darmstadt, the 
openness to society including industry is given right from its foundation in the 19th 
century. We are grateful to our university for enabling the costly environment for 
experimental research including the care for research data being part of Open 
Science. The founder of cybernetics, Norbert Wiener, puts the task of a university 
into words: “The intellectual and technological environment must be right before 
the idea can blossom”.* 

This demanded and given openness also enables the spreading of people (and 
ideas). Holger Hanselka and Roland Platz successfully shaped the research as 
spokesperson and scientific manager to the SFB 805 for the first five years. Daniela 
Wagner has done the project controlling from the very beginning. When Holger 
Hanselka was appointed as President of the Karlsruhe Institute of Technology 
(KIT) in 2013, Peter Pelz took on the task of shaping and leading the research for 
the following eight years until 2021. He has been assisted by his co-workers Philipp 
Hedrich, Ingo Dietrich and Manuel Rexer. In preparing the last funding period Peter 
Pelz was advised by his colleagues Ulrich Konigorski and Jürgen Rédel. 

Most of the former Ph.D. and master students are now transferring ideas to 
industry. Professors are super spreaders of ideas by profession. Hence, it is to be 
rated positively that the former PIs Ulf Lorenz is now at the University of Siegen, 
Lena Altherr at the University of Applied Sciences, Münster. The former Ph.D. 
students Tobias Eifler and Kai Mecke are now teaching and performing research at 
the Technical University of Denmark and the Jade Hochschule Wilhelmshaven. 
Furthermore, three spin offs emerged from the SFB 805, making transfer of ideas 
accessible to industry. 

The editors would like to thank all authors for their contributions from very 
different perspectives, which hopefully make this book worth reading. Finally, we 
would like to thank in particular Nicolas Brötz, Jakob Hartig, Dorothea Saur, and 
Christoph Eyrich for a year of intensive work on this book. They completed our 
team in the discussion with the authors, in the management of the big book project 


“Wiener, N.: Invention: The Care and Feeding of Ideas. MIT Press, Cambridge, Mass (1994) 
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and—very importantly—for the many quality controls and improvements that make 
a book valuable. 


We are pleased that we were able to facilitate an open access book in the spirit of 
Open Science. 


Darmstadt, Germany Peter F. Pelz 
Peter Groche 

Marc E. Pfetsch 

Maximilian Schaeffner 
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Chapter 1 ® 
Introduction hes for 


Peter F. Pelz® 


Abstract In this chapter, the motivation for this book is given. The analysis process 
of socio-technical systems based on data and models is examined from the perspec- 
tive of uncertainty. The synthesis process of systems based on models and/or intuition 
leads to the important concepts of function and quality as well as data, model, and 
structural uncertainty. This forms both the foundation and the introduction to the fol- 
lowing chapters. It is shown that the mastering of uncertainty is the key to Sustainable 
Systems Design. Thus, the societal need for safety and sustainability is met. 


‘Ha, that will be a merry-go-round! 
The bridge must sink into the ground.” 
‘And with the train what shall we do 
That crosses the bridge at seven?” 
“That too.” 

“That must go too!” 

‘A bauble, a naught, 

What the hand of man hath wrought!” 


»Hei, das gibt einen Ringelreihn, 

Und die Brücke muß in den Grund hinein.“ 
„Und der Zug, der in die Brücke tritt 

Um die siebente Stund?“ 

„Ei, der muß mit“ 

„Muß mit.“ 

„Tand, Tand 

Ist das Gebilde von Menschenhand!“ 


The Bridge by the Tay / Die Brück’ am Tay 
by Theodor Fontane (1880) [27] 


P. F. Pelz (BX) 
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How can we ensure product safety in a world of products with ever increasing com- 
plexity? This question arises when designing lightweight structures and sustainable 
systems. The question also comes up when implementing methods and technolo- 
gies for controlled production quality. Mastering uncertainty is central to all these 
topics and requires contributions from engineering, mathematics and law. This book 
provides answers on how to master uncertainty in the life cycle of products from 
the design phase via the production phase to the usage phase. These answers are 
consolidated in strategies to master the uncertainty of a possible product usage, even 
if partly unknown at the beginning of a new engineering design. 


Invitation to visit the building devoted to mastering uncertainty 


We do not intend to represent a definition, a method, or a technology for their own 
sake. On the contrary, the building presented here, consisting of the fundamental 
floor, middle and top floor, inspires the visitor how to master uncertainty in his 
or her specific task. The craftsmen who built this house come from the fields of 
engineering, mathematics and law. Together they have pursued the goal of further 
developing systematic engineering design. To master uncertainty, we always focus on 
the function and quality of the product or system, i.e. its essence from the application 
perspective. 

On the fundamental floor we submit data, models and structures. Here we lay 
the conceptual basis and define consistent uncertainty classes. On the middle floor 
we introduce methods and technologies to identify, evaluate and counteract uncer- 
tainty. On the top floor we introduce the strategies (i) robustness, (ii) flexibility, 
(iii) resilience. All three strategies contribute to mastering uncertainty. 

In order not to develop a method for its own sake, we have tested all tools, i.e. 
definitions, technologies and strategies on the three technical systems that we have 
developed, manufactured and used over the last twelve years. The systems are active 
and semi-active systems. So, flexibility is achieved by the smart systems Active Air 
Spring and 3D Servo Press. All research and its presentation focus on a load-bearing 
example system, which is a lightweight structure. We invite you as our readers to be 
guests in our house and hope that you will profit from your visit. 


The chapter’s structure 


Section 1.1 outlines the motivation and Sect. 1.2 the concept of holistic control of 
uncertainty over the product life phases. In Sect. 1.3, the focus is on the source and 
quality of models. Section 1.4 provides reflections on the sources and quality of data. 
Section 1.5 deals with the structures composed out of components. In Sect. 1.7, a 
broad motivation for mastering uncertainty is presented. The chapter closes with 
an overview of the book’s chapters and the three demonstrator systems designed, 
manufactured and tested at the Technische Universität (TU) Darmstadt during the 
last twelve years. 
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1.1 Motivation 


Back in the year 2008, an interdisciplinary group of about ten researchers designed a 
research program on the topic of this book: Mastering Uncertainty in Design, Produc- 
tion and Usage of Load-Bearing Structures in Mechanical Engineering. This led to 
the Sonderforschungsbereich 805 (SFB, Collaborative Research Centre), which was 
funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Foun- 
dation) in three phases of four years each, from 2008 to 2021. About 60 doctoral 
students have completed their research work during this time. The researchers, all 
members of the TU Darmstadt, have come from fields as diverse as production engi- 
neering, structural mechanics, fluid power, applied mathematics including nonlinear 
and discrete optimisation, statistics, and law. The research topic as such is truly 
interdisciplinary, which is also reflected in the topics of this book. 

The topic from a society point of view is motivated by an increasing number of 
product recalls in the automotive industry. In the era from 1990 to 1995, the number 
of vehicles recalled annually in the US market rose from 5 million to 20 million. In the 
year 2014, 64 million vehicles were recalled contrasting 17 million vehicles sold, see 
Fig. 1.1. Hence, for every vehicle that entered the US market in 2014, four vehicles 
were recalled for lack of safety [10, 28]. In the same year, 1.5 million vehicles were 
recalled and 3 million vehicles sold within Germany [41, 46]. 

Recalls are made on the basis of the Product Safety Act [7]: a recall is required if 
the product causes a sudden and for the user unforeseen serious danger. The decision 
is based on the likelihood of failure during the product’s lifetime combined with 
the severity of possible personal injury [11]. In 2014, the recall of vehicles on the 
German market was in 70% of the cases due to mechanical safety problems and in 
20% due to faults in the mechatronic system, including servo-hydraulics [46]. 

Product safety is equally a strong motivation for mastering uncertainty in the 
capital goods industry, in mechanical and plant engineering, and in the aerospace 
industry. Mainly the following three reasons led to the recalls mentioned: 


CC 
mE 17 m/a vehicles sold 


64 m vehicles recalled in 2014 


Fig. 1.1 Vehicle recalls in the US (left) and Germany (right) in 2014 [28] 
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(i) A conflict of objectives between effort and availability, while, at the same time, 
the future product usage is still uncertain, i.e. the design target is moving. 

(ii) Increased demands on cross-company quality assurance due to the shift in value 
creation to globally developing and producing suppliers with the difficulties of 
communication and interfaces. 

(iii) Increased development speed as a result of global competition. 


As a reaction to the increasing speed of development, systems are more and more 
being developed virtually. This increases the demands on mastering the uncertainty in 
the models during the product life cycle. All of the above-mentioned points form the 
current boundary conditions under which safety-relevant load-bearing structures— 
whether passive, semi-active or active—are developed, produced and used today. At 
the same time, the importance of product safety law is growing. It is to be expected that 
complexity will increase even further, as self-adaptive systems gain in importance in 
the future. 

After one decade of research within the SFB 805, the Boeing 737 MAX accident 
shows that today the mastering of uncertainty in all product life phases is more rel- 
evant than ever: on 29 October 2018, a Boeing 737 MAX airliner crashed because 
of a newly introduced pitch control system. In retrospect, the crash had five causes: 
firstly, insufficient testing of the newly introduced autonomous pitch control system; 
secondly, insufficient training of the pilots; thirdly, sensor failure; fourthly, the over- 
ride control of the pilots by the software; fifthly, the lack of visual feedback to the 
pilots [40]. The crash of the Boeing 737 MAX in its consequence is an extreme but 
at the same time typical example of unmastered uncertainty. 

Hence, there is a growing need to master uncertainty in all phases of the product 
life cycle by 


(i) laying a solid foundation of classification, definitions and metrics of uncer- 
tainty; 
(ii) assessing and developing methods and technologies for quantification, evalua- 
tion and master uncertainty; 
(iii) developing and validating strategies to master uncertainty. 


The three points form the blueprint of our specific approach on mastering uncertainty. 
They are addressed in detail in Chap. 3. 


1.2 Holistic Control of Uncertainty over the Phases 
of the Product Life Cycle 


Figure 1.2 shows the broken out bushing in the bicycle of the author of this chapter. 
The failure occurred during a downhill run in the Odenwald. Due to the failure, 
the wheel guiding and wheel damping functions were completely lost, the wheel 
being blocked. The rider remained unharmed. The bicycle’s usage can be described 
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Riding down this slope of a bike slope broken bushing support 
trail in the Odenwald ended up 

with the broken bushing support 

shown on the right. 


| f ee i 
4. MN 


Fig. 1.2 Broken bushing support of the author’s mountain bike. The failure occurred during a 
downhill run in the Odenwald 


market & 
standards 


ii decisions=f(data, information, money) 
Te a enor cane Ss ago a E penoeres ecewesaee 
1 1 : yi 
resources Production = proauci or reuse x 
system 
gn g material, 
physical 
energy product 


Fig. 1.3 A product or system design, B production, C usage; all phases are interconnected by the 
flow of physical goods and data, information and money 


by factors, such as geography, speed, damper setting, rider’s weight, maintenance 
condition and others. 

But not only the usage has to be evaluated: in order to avoid such a failure, 
the uncertainty over all phases of the product life cycle including product design 
must be viewed holistically. The failure of the load-bearing structure can have its 
causes in unmastered uncertainty in one, two or all three phases (A) product design, 
(B) production or (C) usage, cf. Fig. 1.3. Within this book, we exclude the phases 
resources and reuse. We are aware that sourcing and recycling are important topics 
but they are not what we want to focus on. 
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The phases of the product life cycle are, on the one hand, interconnected by the 
flow of material or physical products. On the other hand, the phases are interconnected 
by the flow of data, as well as information including the flow of costs and profits [21]. 
Although the separation of the product life cycle including product design in phases 
is common [8, 29, 42], methods and strategies for the holistic, cross-phase mastering 
of uncertainty have not yet been developed and validated. The following hypothesis 
can therefore be formulated: 


Uncertainty can be mastered, if uncertainty is described, quantified and evaluated in all 
phases of the product life cycle; further, if it is reacted to and learnt from experience, and if 
follow-up processes are anticipated. 


A process is seen here in a general sense. It may be a production process with an 
input and output of a physical material flow. It may also be the usage of a component 
of a load-bearing structure, such as a suspension strut, or a system being composed 
of many such components. 

Following the chain from sourcing to production, to usage and reuse, it is evident, 
that the uncertainty of a specific product property propagates downstream. Provided 
this process is unmastered, an accumulation of uncertainty from process step to 
process step can occur. The task is to master a possible accumulation of uncertainty 
or even reduce the uncertainty along the process chain. Therefore, the product stress 
and strength or changes in load and system degradation should be quantified and 
evaluated in the usage phase, and fed back to the design and production phase. This 
is the outer closed control loop of mastering uncertainty. For subordinate control 
loops and complete transparency, the uncertainty should be described, quantified 
and evaluated after each process step in all phases. The feedback loops are ideally 
closed across all phases, sketched in Fig. 1.3. 


Classic approach to master uncertainty by safety factors 


Trained engineers are used to safety factors. A safety factor serves to absorb all 
uncertainties of the design, production and usage phase. For example, a lack of 
knowledge about the product usage typically leads to oversized systems. This is 
understandable, since the function of the product is of primary importance for its 
use. How the “quality” of this function is fulfilled ranks second. Oversizing may 
not necessarily be a shortcoming for the customer. However, it leads to the fact that 
design, production and usage are not sustainable. That this is quite serious can be seen 
from a simple number. In order to operate fluid systems in Europe in the year 2014, 
the estimated energy amount of 900 TWh was required [32]. 

The spatial separation of “generation” and use of (electrical) energy was pushed 
forward in the 19th century by Werner von Siemens. We will concentrate here only 
on the consumption side: the electrical energy that drives the fluid systems in use 
is provided by the output of about 100 large thermal power plants. It is estimated 
that 40 power plants alone could be saved by sustainable planning and operation 
of the fluid systems [32]. The driven machines on the consumption side serve the 
functions of cooling, heating, ventilation, transport, mixing, dosing as well as the 
power transmission from and through liquids and gases. The example drastically 
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Fig. 1.4 Generic probability density function of properties 6 of production p(@p) of the strength 
Op and usage p(Ou) of the stress 0y with mastered uncertainty in (a) design (A) and production (B) 
and (b) usage (C) [15] 


illustrates the effect of oversizing. In the Anthropocene, saving energy in the use 
of energy consuming systems should be our priority. The good news is that sus- 
tainable systems design is promoted by the methods presented in this book, among 
others. 

Accounting for uncertainty by safety factors is illustrated in Fig. 1.4. If we think 
of a load-bearing system, the function is described by a load history resulting in the 
system’s stress. Here, the stress of the system shall be smaller than the strength of 
the system; otherwise there would be a failure. This happened to the Tay Rail Bridge 
on the night of the 28 December 1879 in a strong winter storm, only 19 months 
after its opening. Theodor Fontane then wrote his ballad “The Bridge by the Tay’ 
with the line “A bauble, a nought, what the hand of man hath wrought!” (in German 
““Tand, Tand ist das Gebilde von Menschenhand”’), cf. quotation at the beginning 
of this chapter. Fontane, as a representative of society, criticises the unrestrained 
uncertainty in this poem. In fact, the wind load and, thus, the stress during the usage 
phase was underestimated in the planning [22]. 

This is indicated in Fig. 1.4a where there is an overlap between the probability 
density function p (0y) of the stress Qu in the usage phase with the probability density 
function p(@p) of the strength @p in production. Both are influenced by the system’s 
design and production. 

In the framework of stochastic uncertainty, cf. Chap. 2, the density function of the 
feature 9 has mean 9 and standard deviation o (9). Hence, mastering uncertainty in 
the design and production phase, Fig. 1.4a, may be reached by increasing 6p and/or 
reducing o (05) < o (dp). 
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Knowing the uncertainty of stress and strength enables potential savings in mass, 
energy or other metrics that measure effort. Mastering uncertainty in the usage phase, 
Fig. 1.4b, may be reached by limiting 0y and/or reducing o (6{,) < 0 (u). This may 
be reached by adapting semi-active components or using active components. 

In response to the Tay Bridge disaster, the second bridge of the railway line on 
the east coast of Scotland, the Forth Bridge, opened in 1890, and was significantly 
oversized. Thanks to new production methods—smaller fluctuations of semi finished 
and final products by quality control—and the avoidance of oversizing, it can be 
assumed that only half of the steel used would be needed today. 


1.3 Components are Represented in Models 


The basis of decisions made by humans or machines is information derived from a 
representation of a process, i.e. a model [19, 25]. Each model serves the purpose to 
represent the relevant part of reality and derive specific information out of the model. 
Hence, there are no general, purpose-free models. Since models are the prerequisite 
for evaluating the propagation of uncertainty in process chains, designing and opti- 
mising robust systems and selecting suitable process chains or structures from the 
solution space, a careful inspection of models is needed. This is even more important, 
as models connect data and structures, as will be seen, cf. Chap. 2. 

The object to be represented by a model is a component or process of a technical 
system. In mechanical engineering, we distinguish between physical and software 
components. Each fulfils a sub-function of a system. Functions can be combined to 
form a module, an assembly, a sub-process chain or a single process. In the following, 
we use the representative term component. 

A model represents only a part of the relevant reality. The model may even cover 
a part of the unreality. The data are embedded into the models. This is illustrated by 
the schematic Fig. 1.5: Data are linked to the models. Therefore, they are represented 
as a subset of the model. The boundary between relevant reality and the model is 
called model horizon [18]. The part of relevant reality not represented by the model 
is ignorance. 

The model horizon is concisely described by the trained engineer and later philoso- 
pher Wittgenstein “The limits of my language mean the limits of my world” [47]. 
This does not mean, that every model has to be written in the mathematical language. 
Experience and implicit knowledge, which are often the basis of intuition, can also 
be regarded as a model. In fact, engineering design and production is often based on 
intuition. Intuition should therefore not be confused with ignorance. 

The physicist and philosopher Heinrich Hertz, judged models with respect to their 
conciseness and simplicity. Hertz [19] demands that a model should be 


(i) consistent, in a logical sense; 
(ii) correct, i.e. the model implementation is done properly, and the model provides 
an appropriate map of the technical system; 
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Fig. 1.5 Euler diagram to clarify relevance, ignorance, model and model horizon: socio-technical 
reality is separated in relevant and irrelevant reality. This separation is task-dependent. Humans or 
machines generate representations of this relevant reality, i.e. they model the relevant reality. It is 
not possible to completely model the relevant reality. The uncovered part of the relevant reality 
is named ignorance. The boundary between the model and the relevant reality is named model 
horizon. Data are formed by the values of parameters and process variables. Modelling only a part 
of the relevant reality is summarised by “there’s more to the picture than meets the eye” [48] 


(ili) concise, i.e. it should contain as few empty relations and assumptions as pos- 
sible. 


The latter requirement is known as the principle of simplicity. In the following, we 
shed some light on the three requested features of a model: consistency, correctness 
and conciseness. 

Firstly, a model is considered (i) consistent with a theory framework if the model 
is free of contradictions to the knowledge represented by that framework. Simple 
examples illustrate the demand for consistency and the difference between consis- 
tency and correctness: a polynomial model or a neural network, both data-driven 
models, can certainly represent measurement data, such as a stress-strain relation of 
an elastomer or an adsorption isotherm of a gas and its adsorption material. There- 
fore, most engineers refer to the two models as correct or verified because they 
represent reality in a sufficient precision. The correctness may be quantified by the 
confidence and prediction levels of the model. In order for the models to be consis- 
tent with a more general theory framework, both models shall be consistent with the 
second law of thermodynamics [17]. If this demand for consistency is ignored, model 
uncertainty can be dramatic when the models are applied outside their calibration 
range. Vice versa, consistency reduces model uncertainty. Axiomatic i.e. deductively 
derived models are consistent per se, cf. Fig. 1.6. Consistency of data-driven models 
is improved by Bayesian inference using prior knowledge, see Fig. 1.6. A prominent 
example for this is Kalman filtering first used in the Apollo program 60 years ago for 
trajectory prediction [2, 23]. 

In today’s language, consistency and verification are used synonymously. In the 
context of this book we follow this common usage in Chap. 2 and beyond, knowing 
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Fig. 1.6 Mapping of the real or cyber world to the world of intuition, inspiration, ideas, theories 
and knowledge by analysis and synthesis 


that Hertz and empiricists like Hume or Popper understand the process of verification 
differently. 

Secondly, it is important to stress, that from Hertz’s point of view, widely used 
verification and validation processes address only the second of Hertz’s demands, the 
(ii) correctness. Design engineers on the one hand and scientists on the other hand 
use the term verification in the above mentioned sense. If it is about the engineering 
design process of a product (physical or cyber), then verification is the examination 
of the specification-compliant implementation and work of models, methods and 
technologies. 

For the empiricists it is about the ‘truth’ of models. According to Karl Popper, 
the ‘truth’ of physical models is in principle not generally verifiable: the hypothesis- 
model, i.e., the model “all swans are white” is falsified by the proof that black swans 
actually exist. 

Here, too, there is an ambiguity: when scientists speak of the validity of a model, 
they evaluate the ‘truth’ of the model by comparing the model prediction with real- 
ity. According to Popper, this can only be done for a limited empirical context. This 
narrower concept of truth has proved extremely successful in the natural and engi- 
neering sciences since Galileo Galilei. This concept of ‘truth’ is a very successful 
concept. 

Therefore, natural scientists should rather stick to the concept of verification in 
order to have a clear language, but we will not change this. For designers the language 
is clearer. When design engineers talk about product validation, they have acceptance 
in mind. They ask: Does a product fulfill its purpose and is it accepted? This means 
the product is useful. 

Thirdly, the requirement for the (iii) conciseness or simplicity of a model has 
so far been underestimated when dealing with uncertainty. Two models serving the 
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same purpose may both be equally consistent and equally valid but may differ in 
the number of assumptions needed to form the model [19]. To quote the medieval 
philosopher William Occam [30], a father of modern epistemology: “frustra fit per 
plura, quod potest fieri per pauciora”, i.e. 


it is unnecessary to let something happen by several [factors], which can also happen with 


few [factors]. 


This applies to axiomatic models, but also to data driven models [1]. The principle 
of simplicity is known as Occam’s razor in philosophy of science [30]. 

Scientists tend to model more and more nuances. Engineers tend to get lost in 
the details of a design. That is because it’s easy to be complex but it’s difficult to be 
easy. By doing so, there is a danger of losing the essence of a technical system out 
of focus. This implies the function, the effort to gain this function, the availability of 
the system and the system’s acceptability. 

Why is simplicity so important in the context of mastering uncertainty? Each 
unnecessary assumption or relation is a source of uncertainty. This becomes relevant 
for forecasts or extrapolation, when a model is to be applied outside its calibration 
range. This is important in the context of resilience, as a strategy to master uncertainty, 
cf. Sect. 6.3. Resilient systems are capable to anticipate downstream processes. 

Today Occam’s razor serves as guiding principle for axiomatic and more and more 
for data driven models [24]. 

In summary, simplicity, i.e. conciseness and also consistency reduce uncertainty, 
whereas the correctness of a model does not per se reduce uncertainty. This is rele- 
vant if models are to be used for forecasting, forward control, model prediction or 
anticipation of downstream processes. 


What are the sources of our models? 


In the above, we have used the terms axiomatic and data-driven models. The former 
is seen here not only for first principles, but also as a synonym for the state of 
knowledge, ideas and theories, which are independent of a specific application or 
even context. 

As Fig. 1.6 schematically shows, the sphere of intuition, inspiration, ideas, the- 
ories and knowledge is filled by an upstream pipe, the analysis, formed out of (i) 
measurements done in the real or cyber world, (ii) aggregation of the measurements, 
(iii) induction of general relations, by possibly using prior knowledge. This prior 
knowledge may be accessible by the Bayesian inference or other means deducted 
from the sphere of ideas, cf. Sect.5.3. The philosophic problem of induction dis- 
cussed above is in the engineering science only of minor relevance. 

Today, this upstream pipe is very successfully used in data-driven modelling or 
black box modelling, e.g. in industrial image processing. The great success, ease of 
use and low threshold of expertise lead us to consider such models as a panacea. 
They work successfully when, for example, image data are available in abundance. 

The focus here is on overcoming uncertainty. The question arises whether data 
driven models are sufficient to enable the design process. It is inherent in the inno- 
vation process that the technical system is only just emerging. Therefore, only a 
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limited amount of data can be collected in the early phase. Consequently, the situ- 
ation of small data instead of big data is typical for the composition and operation 
of innovative technical systems. The models required by the engineers are therefore 
initially white box models deducted or adopted from a general theory, knowledge 
or experience. In summary, the synthesis of physical or cyber products is always 
triggered by an intuition. In the context of Sustainable Systems Design, this idea is 
motivated from a society need. The consequent methodological system design has a 
deduction phase (iv) and a composition phase (v). In the deduction phase component 
models are derived. Those component models are composed i.e. connected forming 
a system fulfilling the society needs ideally sustainable. 

The upper sphere shown in Fig. 1.6 is not homogeneous.“I believe in intuition 
and inspiration. [...] Inspiration is more important than knowledge.” [45]. Thus, 
Einstein is consistent with David Hume, who considered the interplay between ratio 
and inspiration: “Reason is, and ought only to be the slave of the passions.” The 
engineer, the homo faber, needs both inspiration and knowledge in an outbalanced 
interplay. 

Sometimes prior knowledge may be used. This may be supplied from another 
context or a physical model test, cf. Sect. 4.3.6. As often, there is no black or white. 
Today the combination of both, upstream and downstream modelling approaches is 
common. The results are so-called grey box models, where grey is a mixture of the 
white axiomatic models with the black, i.e. data driven models. It remains a task 
integrating implicit knowledge into grey box models. 


“All models are wrong, some are helpful” 


is a quote from Box [4]. Models are inherently uncertain as Fig. 1.5 indicates. With 
regard to model uncertainty, cf. Sect.2.2, models may have either an unsuited struc- 
ture to model the relevant part of the reality or model parameters may be uncertain. 
It is evident that model uncertainty, due to an unsuited model structure, cannot be 
mastered by mastering the uncertainty of the model parameters. This is indicated by 
the Euler diagram shown in Fig. 1.5. Nevertheless, many engineers still cling to their 
familiar models, even if a model is unsuitable. By calibrating the model parameters, 
originally axiomatic models are degenerated to data-driven models without being 
recognised as such by the user. A wrong model structure is not helpful. 


For example, an unsuitable structure may be given when trying to model a diffusion problem with 
an elliptic partial differential equation, if a parabolic equation is suitable. An unsuitable structure 
may also be present when a journal bearing is modelled using the Reynolds’ equation of lubrication 
theory, even if the product of Reynolds’ number Re and relative clearance W is greater than one. 
In this case the inductance within the bearing itself is a relevant part of reality. This inductance is 
ignored in classical lubrication theory, which is part of most engineering education. Dimensionless 
model parameters, such as the product of Reynolds’ number and relative clearance y Re, are often 
weights of the different terms of a model resulting from a dimensional analysis. 


To sum up, it is often the engineer’s experience and his or her ability to evaluate the 
applicability of a model. 
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1.4 Data and Data Sources 


Data are connected to physical or cyber components, which in turn are mapped to 
the models. This is the one side of the system. The other side is the structure with its 
individual components. 

The data addressed here can be the value of any model parameter or any measure- 
ment signals gained from a process. There are three main data sources: 


(i) the process itself, 
(ii) a representative process, 
(iii) the archived data. 


For sources (i) and (ii), the data may come from (a), a sensor in the real (physical 
sensor) or cyber world (simulation data), or (b), a soft sensor. A soft sensor combines 
a model with a physical sensor to derive data that are not physically accessible with 
limited effort [16]. Provided the process itself delivers signals by means of integrated 
sensors, cf. Sect. 4.2.2. 

A representative process (ii) is firstly a sample test, where the sample’s properties 
are assumed representative for all similar parts; it is secondly a physical model test, 
where the model may be a scaled prototype. Performing a sampling inspection is 
common in quality assurance. Testing a downscaled physical model is common in 
turbo-machinery, aerospace and marine industry [38]. The necessary scaling methods 
are based on the Bridgman postulate [5] and the Buckingham Pi-theorem [6]. In 
both cases, the data are gained offline of the relevant process. This might have the 
advantage that measurement uncertainty is reduced. But any offline test must take into 
account physical dissimilarity. This dissimilarity may be treated by scaling methods, 
which are a source of uncertainty [20, 43], cf. Sect. 4.3.6. 

The archived data (iii) can be quality-assured, i.e. findable, accessible, interop- 
erable, reusable (FAIR). This requires data governance and curation. The storage 
has to take place in such a way that the raw data are linked to their metadata in a 
machine-readable form [13]. Often archived data are not FAIR. Archived data are 
also fuzzy data remembered by an engineer or worker. 

Data quality has two sides [13]: firstly, formal data quality achieved by following 
the FAIR-principles, and secondly, content quality. Since uncertainty is associated 
with trust in data [14, 15], formal data quality should not be ignored: the higher the 
formal data quality, the more the data is trusted. A detailed view on data quality is 
given in Sect. 2.1. 

Two or more data sources can be used simultaneously to derive information. This 
data fusion will lead us to a concept called data-induced conflicts, which will be 
discussed in Sect. 4.2. It is a concept that allows to assess confidence in data sources 
but also model uncertainty. 
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1.5 Component Structures 


Structures consist of components, physical components and/or cyber components, 
i.e. algorithms in the form of software. Having treated component models and data, 
we come to the system level represented by the term structure. 

In the classical engineering design [29], the system’s function is usually the start- 
ing point from where a system’s functional structure with related sub-functions is 
derived, cf. Sect.3.3. The system’s function structure is independent of a product, 
process or system realisation. After the decision on the integration or separation of 
the functions into individual physical or cyber components, the functional structure 
of the system is mapped to the components. These form the real system. 

The decision about the integration or separation of the functions is guided by 
the mastering of the internal and external complexity. This decision process is the 
foundation of modular design, which allows an economic scaling. An illustrative 
example of modular design obtained by intelligent function integration and function 
separation is shown in Fig. 3.19. 

With respect to the system’s function and quality, a quantitative evaluation of the 
system’s uncertainty is only possible at the system level; we evaluate the system’s 
uncertainty with respect to effort, availability and acceptability, frequently being 
only possible at the component level. Structural uncertainty, cf. Sect.2.3, therefore 
results from the fact that a multitude of possible functional structures can be found 
for a system’s function that is still subject to uncertainty; and in turn a multitude of 
component structures can be realised for each functional structure. This results in a 
combinatorial explosion of the solution space [39], which is only partially compre- 
hensible and assessable for humans. The unnoticed part of the solution space remains 
in the area of ignorance due to this structural uncertainty [33]. 


For example, the difference between data, model and structure is exemplified by the design task 
of a hydrostatic transmission sketched in Fig. 1.7. Figure 1.7a shows a double-acting piston, whose 
force-displacement curve has to be controlled by a structure or system formed out of the sketched 
components, i.e. the hydraulic valves. Figure 1.7b shows the load history, which may be uncertain. 
The system’s function is described by such a load history. 

Each valve is a component being described by a functional relation of input u, output z and model 
parameters m: f(u,z,m,...)+6f = 0. Here, the model f of the valve arises from a differential- 
algebraic system of equations, and ôf is the residuum between model and reality. The operational 
inputs u determine the valve position, density, pressure difference and particle concentration. The 
parameters m include the maximal valve opening and diameter. The output is given by the wear 
history. Thus, the time-varying flow-characteristic and at the same time, the evolution or wear due 
to particle erosion are described, cf. Sect.3.3. Hence, the wear for an arbitrary load history and 
structure is given [44]. 

The system is composed of different admissible components schematically collected in the 
design space as sketched in Fig. 1.7. The design space with admissible structures all fulfilling the 
demanded function is so large that it cannot be explored manually. The different design solutions 
S all differ in the system’s degeneration due to particle wear. 

If only one solution out of the design space is selected and the countless other solutions are 
ignored, we call this form of uncertainty firstly structural uncertainty and secondly ignorance. 
Only if an optimal structure Sop: is selected, here Fig. 1.8b, with regard to minimal particle erosion, 
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Fig. 1.7 a Design task of a hydrostatic transmission with minimal particle wear. The pressure 
source of a pump (high pressure) and the tank (atmospheric pressure) is to be connected by a so far 
unknown structure of hydraulic valves with a double-acting hydraulic cylinder; when the pump is 
connected to the left volume and the tank to the right volume, the cylinder extends; b the function 
is described by a load history; the control valves shall be selected from a field of possible hydraulic 
valves; the right half of the valves allow the pressure drop to be adjusted. The representation of the 
possible hydraulic valves implies that any structural solutions S are possible [44] 
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Fig. 1.8 Design for a ignored structural uncertainty, b minimal wear; the availability with respect 
to wear due to particle erosion is increased by a factor of 16 [44] 


we speak of mastered structural uncertainty. Figure 1.8a shows the usual design using a standard 
4/3 directional control valve with the optimal structure Sopt showing minimal wear as in Fig. 1.8b. 

Data uncertainty 0 = 0 + 60 and model uncertainty f(u,z,m,...)+ ôf = 0 have to be 
encountered in the structural uncertainty. They propagate into the structure S. There are some 
examples in this book how this is achieved by means of robust optimisation, see for example 
Sect. 6.1.1. 
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1.6 Sustainable Systems Design—The Extended Motivation 
for This Book 


In Sect. 1.1 the topic ‘mastering uncertainty’ is motivated solely by product safety. As 
Figs. 1.2 and 1.3 exemplify, product safety is determined mainly by its load-bearing 
capacity, i.e. the system’s function. A broader scope of the process chain, system 
or structure will guide us to an extended motivation to master uncertainty. For this 
reason, we first discuss the relations of function, effort, availability and acceptability. 


Towards optimal quality subject to functionality 


The design variants are denoted by x. The system’s function and additional con- 
straints are given by relations of the type g(x) < 0, cf. Fig. 1.9. An example of such 
a constraint is e.g. seen in Fig. 1.7b. At this point, the discussion about structural 
uncertainty shows that the design variants x differ for each structure S. Hence, the 
paradigm ‘form follows function’ created by the American architect Louis Sulli- 
van, at the beginning of the 20th century, is not an objective, it is a constraint. The 
missing objective is ‘less but better’ created by Rams and Klatt [35]. The renowned 
German designer Dieter Rams having worked many years for the company of Braun, 
demanded in the mid of the 20th century: ‘Weniger, aber besser’! This is the missing 
objective. In the optimisation, we are not only looking for better quality measured 
in effort, availability and acceptability, but Pareto optimal quality. Hence, the two 
paradigms ‘form follows function’ and ‘less but better’ are evolving into ‘towards 
optimal quality subject to functionality’. The union of both paradigms is the guiding 
principle when designing, manufacturing and operating systems under uncertainty. 
The achievement of ‘optimal quality with consideration of functionality’ is what we 
call ‘Sustainable Systems Design’. 


acceptability = F3 minimise effort, maximise availability & acceptability, 
A: min [F = {F,,—F,, —F3}], subject to the functions of 
the system are fulfilled, i.e. g(x) < 0 


objective function 


system's F(x) = const. 
functions admissable design 
g(x) <0 Ce) space g(x) < 0. 
effort = F, availabilty = F, ; 
g o = 


optimal design 
point 
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Fig. 1.9 Equivalence of a the Sustainable Systems Design and b the constrained optimisation 
problem 


1 Introduction 17 


What is our understanding of function and quality? 


The objectives are (i) minimise effort F;, (ii) maximise availability F, and (iii) 
maximise acceptability F3. The three objectives are often conflicting. Hence, the 
multi-criterial decision problem min [F = {Fı, — F2, —F3}] leads to a Pareto set of 
optimal solutions [12]. The selected optimal solution always depends on the ranking 
of the three objectives (i) effort, (ii) availability, (iii) acceptability. 

Linguistically, the system’s function is described by verbs, such as to carry, store 
or transport. The function is mostly further specified by a load spectrum or load 
history. The objective function is determined by the quality of how the function 
is fulfilled. Here, quality symbolises the adverb to a verb, namely a function, like 
for example efficient transport. The adverb, i.e. the quality, characterises the three 
aspects of effort, availability and acceptability. 


(i) Effort is measured, for example, by the total cost of ownership. Sometimes 
only the material or energy consumption are measured. In the usage phase of 
lightweight structures, the weight is the determining factor for the effort. 

(ii) Availability can be measured, for example, by the sum of the mean time between 
two failures and the repair time relative to the total time. Alternatively, the 
anticipated remaining service life can also be specified. For this purpose, an 
assumption regarding future usage and an ageing model are necessary. A gen- 
eral ageing model is presented in Chap. 3. 

(iii) From the three measures of the objective function, the acceptability is the most 

difficult measure. Acceptability has two sides, a formal and an informal side: 
A formal aspect of acceptability, presented in Sect.5.1 lies in the conformity 
with regulations, such as the Product Safety Act [7]. Formally, acceptability 
can also be achieved through a regulation. For example, an ordinance can be the 
function of an electronic stability control system (ESP) mandatory for vehicles. 
For formal acceptability, the politically consented society needs are cast into 
regulations. Either products have to meet the regulations or the regulations 
demand defined technologies. 
The counterpart to the formal side of acceptability is the informal acceptability 
gained through positive user experiences. The user may be a consumer in the 
consumer goods market, but also a company in a business-to-business market. 
This user experience has many facets and it would go far beyond the scope of 
this book to fully immerse into this field. Schmitt coined the term perceived 
quality in this context [37]. Instead, we focus on the facet product quality being 
important for informal acceptability. 


It is obvious that the higher the experienced quality of a product and the lower 
the effort measured against the costs, the higher the acceptability. The quality is 
measured on the one hand by the expected functional performance given by the 
deviation ôg = gs — g from the expectation, cf. the 3rd case study in Chap.3, and 
on the other hand by the expected effort Fy and by the expected availability F2. As 
Fig. 1.10 shows, g, is the specified function and g is the realised function. 
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Fig. 1.10 Sustainable Systems Design presented as a closed loop, indicating the localisation of 
model uncertainty, structural uncertainty and data uncertainty, which is dealt with in Chap. 2. The 
process of system specification between different stakeholders is a source of uncertainty, which is 
discussed in Sect. 5.1.1 


Customer expectations must match the quality promise. This is either explicitly 
given by the manufacturer or it must be consistent with the usual market quality. If 
necessary, the quality is also defined in regulations, see Sect. 5.1. Here, too, it can be 
seen that the various aspects of a product depend on each other: formal and informal 
acceptability overlap in parts. 

The schematic representation of the constrained optimisation problem as a closed 
control loop helps identifying the different uncertainty sources, Fig. 1.10: model 
uncertainty, structural uncertainty and data uncertainty, which is dealt with in Chap. 2. 
The dynamic process of system specification between different stakeholders is a 
source of uncertainty, which is discussed in Sect. 5.1.1. 

Sustainable Systems Design is model-based: the system function g and system 
quality F is evaluated on the basis of models. The recognition, evaluation and mas- 
tering of model uncertainty, cf. Sect. 2.2, is thus one core of this book. By integration 
of functions or separation of functions, by combination of materials and compo- 
nents often more than seven competing systems fulfil the same specific function 
gs. The number seven is known to be the limit on human capacity for processing 
information [26]. Roughly speaking, all other possible variants remain in the field 
of ignorance for people in system design. This structural uncertainty can only be 
controlled by algorithms discussed in this book. For this, rules of the game and sys- 
tem boundaries have to be set. This must be recovered by the stakeholders. In order 
to quantify the system quality in the evaluation step, metrics for effort, availability 
and acceptability are necessary. The evaluation of the function and quality requires 
models, see Chap. 3. Secondly, weighting factors w; are necessary. In the evaluation 
step, Pareto surfaces can be presented. 


1 Introduction 19 


Pareto front 
passive of the ideal 


15~ reference active system 
vehicle _ 


IEN 


0 
De 
S = — 
ae standard °? 80 100 
functional 


functional quality Fz 
standard deviation of the 
body acceleration 

o(Z,) in m/s? 


+ 


20 40 60 


mer 0 
f deviation of the time-averaged available acuating power 
quality F3 transient relative per corner in W 
wheel load effort F, 
a(Fw)/F, w,0 


Fig. 1.11 Improvement of system performance by an active component, here the Active Air Spring 
introduced in Sect. 3.6.2. A compact car is driving over a country road at a speed of 70 km/h. The 
standard deviation of the body acceleration is plotted versus the time-averaged actuating power in 
W and the standard deviation of the relative wheel load. The white circle is the reference for the 
vehicle with a passive suspension system [36] 


As good as it gets—orientation helps mastering uncertainty 


The demand to improve quality beyond an existing Pareto surface requires an 
extended playing field or altered rules of the game. This is achieved by new tech- 
nologies. A Pareto line for a chassis design using an Active Air Spring as component 
is shown in Fig. 1.11. The effort F, in the example of an active chassis may be 
defined by the power consumption. The acceptability in the example F3 is given by 
the functional quality of the suspension system. The sub-functions are isolating the 
body and reducing wheel load fluctuation, i.e. to foster driving safety. As seen in 
the figure, the position of the Pareto line is determined by the available power of the 
active component. However, there is often a technology-independent, i.e. asymptotic 
Pareto boundary. The question ‘what can be achieved in the optimal case, if there is 
no limitation, for example to the power?’ can often be answered. 

In engineering sciences, this asymptotic Pareto line or surface is determined by 
physical laws. The most prominent Pareto surface is the Carnot efficiency of a thermal 
power plant. Due to the second law of thermodynamics only the fraction 1 — 7, / T> 
of the input heat flux Q may be transferred into mechanical power Ps. The knowledge 
of this asymptote i.e. Pareto surface motivated engineers to increase the combustion 
temperature T) more and more (7; is the ambient or cooling temperature). This 
triggered the development of high temperature material. For wind power [3] and 
water power [31, 34] we have similar upper limits independent of the system design 
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and operation. For ‘energy production’ a clear asymptotic upper limit can often be 
given. These upper limits have names like Carnot law or Betz law. For active systems, 
i.e. energy consuming systems, it is also possible to specify Pareto limits. Often these 
are much more complicated to find and are unfortunately still hardly used in industry 
for orientation. 

Even for an ideal, active system, which consumes whatever energy, the goals 
can still be contradictory. Figure 1.11 shows a energy consuming system. Design 
solutions that lie at the asymptotic Pareto boundary are reference solutions of the ‘as 
good as it gets’-type. 

Pareto surfaces and asymptotic Pareto boundaries offer an orientation for design- 
ers that should not be underestimated. Not every case requires an optimal solution. 
However, the aim should be to know the distance from the optimal solution. This 
helps to counteract the often prevailing lack of orientation. 

The need for deep diving is expressed by the British designer Jonathan Ive at the 
beginning of this century: “you have to deeply understand the essence of a product 
in order to be able to get rid of the parts that are not essential” [9]. The essence is 
the system’s function g and the system quality F seen from the user’s perspective. 
The way to sustainability is cleared by optimal quality subject to functionality. 


1.7 Outlook on the Following Book Structure 


Mastering uncertainty in the phases design, production and usage does not only refer 
to the system’s function but also to (i) effort, (ii) availability, and (iii) acceptability, 
as depicted in Fig. 1.9. Hence, product safety stands next to other motivations all 
covered in this book from a specific point of view: 


(i) Ensuring product safety, 
(ii) realising lightweight structure and Sustainable Systems Design, 
(iii) controlling production quality. 


The schematic Fig. 1.11 shows that mastering uncertainty may lead to resource sav- 
ings. This is immanently important for lightweight structures where the weight is to 
be minimised for a given load-bearing function. The example sketched in Fig. 1.8 
is an example of a Sustainable Systems Design under uncertainty, where the wear 
was minimised. In production, the control of uncertainty can save costs by making 
processes more flexible and adaptive. In Sustainable Systems Design, the control of 
uncertainty leads to robust or even resilient systems. 


The three floors of mastering uncertainty in mechanical engineering 


We organise this book with a picture of a truss structure, shown in Fig. 1.12. The truss 
structure has three floors. These are, firstly, the fundamental floor built from terms 
and definitions, secondly, approaches to uncertainty quantification on the one hand 
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Fig. 1.12 Framework of mastering uncertainty presented in this book mapped on a truss structure 


and methods and technologies on the other hand, and thirdly, strategies to master 
uncertainty. 

The fundamental floor (I) is formed by the motivation as well as the reflection on 
data and models given in this chapter, the lower left bar in Fig. 1.12. At the beginning 
of our research more than ten years ago, it became clear that for mastering uncertainty 
a definition of uncertainty classes is important. Only when things are defined by name 
do they become tangible. The motivation and discussions in this chapter and Chap. 2 
describe the classification of uncertainty into stochastic uncertainty, incertitude and 
ignorance by the first classifier and into data, model and structural uncertainty by 
the second classifier. This results in the matrix of uncertainty classes, shown in 
Fig.2.2. With the first three bars and chapters the foundation is given for a solid 
middle floor. Chapter 3 provides our specific approach on mastering uncertainty. 
Within Chap.3, we introduce three technical systems created, tested, and verified 
in the context of mastering uncertainty. The first system is a load-bearing structure 
representing a generic light weight structure called Modular Active Spring-Damper 
System; the second system is the Active Air Spring — a technology which is ideal to 
prevent kinetosis when driving autonomously; the third system is the 3D Servo Press 
allowing flexible production and a closed-loop control of the product properties. 
These three systems, all developed manufactured and validated from scratch at TU 
Darmstadt during the previous decade, form the heart of the book. They will be 
highlighted from different perspectives. The central bar Chap. 3 is connected via the 
two supports to the state of the art mechanical engineering, applied mathematics 
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and law. The engineering view differs significantly in method and language from the 
mathematical view. This is no drawback but makes the book interesting to read—so 
we hope. 

The middle floor (II) is formed first by Chap. 4 and then by Chap. 5. Chapter 4 
deals with the methods to analyse, quantify, evaluate uncertainty in single processes 
and their propagation in process chains. Sections 4.1 and 4.4 are devoted to the 
identification and visualisation of uncertainty. Section4.2 deals with the methodol- 
ogy of ‘data-induced conflicts’ for the identification of data and model uncertainty. 
Section 4.3 provides insight into model uncertainty from different perspectives: opti- 
mal design of experiments with respect to the evaluation of model uncertainty, model 
uncertainty related to hardware-in-the-loop testing, as well as scaling under uncer- 
tainty. In summary, Chap. 4 provides the basis for the identification and quantification 
of uncertainty in mechanical engineering. Chapter 5 deals for the first time with the 
mastering of uncertainty itself by introducing methods and technologies to master 
uncertainty. This includes the management of product safety from a regulatory per- 
spective, Sect. 5.1. Design methods to master uncertainty are discussed in Sect. 5.2. 
Active and semi-active processes are often needed to react to changes in the usage and 
production phases. A controlled process chain, i.e. a system is described in Sect. 5.3, 
active components and single processes are discussed in Sect. 5.4. 

The top floor (III) is devoted to strategies of uncertainty mastering. This floor 
builds on floors (I) and (II). We discuss three strategies: robustness Sect. 6.1, flex- 
ibility Sect.6.2, and resilience Sect.6.3. Progress in discrete and nonlinear robust 
optimisation methods is presented together with robust production processes and 
development methods for a robust system. 
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Abstract The goal of this chapter is to define different types of uncertainty in tech- 
nical systems and to provide a unified terminology for this book. Indeed, uncertainty 
comes in different disguises. The first distinction is made with respect to the knowl- 
edge on the source of uncertainty: stochastic uncertainty, incertitude or ignorance. 
Then three main occurrences of uncertainty are discussed: data, model and structural 
uncertainty. 


In this book we focus on physical and cyber-physical systems that are designed, 
manufactured and used. Hence, our context is that of engineering design, production 
and usage, in combination with applied mathematics providing methods and strate- 
gies as well as law providing a social and judicial framework. Uncertainty occurs in 
every step of system design, production and usage and needs to be anticipated in the 
design phase. Supporting the analysis, this chapter is concerned with different types 
of uncertainty and their quantification. 

Indeed, before mastering uncertainty, uncertainty has to be identified. In order 
to do so, it is helpful to define individual uncertainty types. We classify uncertainty 
using two independent classifiers identifying its appearance and effect. The first clas- 
sifier captures the effect of the uncertainty on the system at its core. It distinguishes 
between stochastic uncertainty, incertitude and ignorance. The resulting decision 
diagram is shown in Fig.2.1. The second classifier distinguishes data, components 
and structures. Together they lead to the 3 x 3 matrix shown in Fig. 2.2. 


P. F. Pelz (IX) - T. Melz - R. Platz - M. Schaeffner 
Department of Mechanical Engineering, TU Darmstadt, Darmstadt, Germany 
e-mail: peter.pelz@fst.tu-darmstadt.de 


M. E. Pfetsch - S. Kersting - M. Kohler - A. Matei - S. Ulbrich 
Department of Mathematics, TU Darmstadt, Darmstadt, Germany 


T. Melz 
Fraunhofer Institute for Structural Durability and System Reliability LBF, Darmstadt, Germany 


© The Author(s) 2021 25 
P. F. Pelz et al. (eds.), Mastering Uncertainty in Mechanical Engineering, 

Springer Tracts in Mechanical Engineering, 

https://doi.org/10.1007/978-3-030-78354-9_2 


26 P. F Pelz et al. 


uncertainty of the 
process state 


unknown 


on function g and 

known on quality 

(i) effort F; 

(ii) availability F, 
(iii) acceptability F3 


stochastic incertitude ignorance 
uncertainty 


e.g. stochastic data e.g. tolerances e.g. arbitrary 
determination based 


on a lack of knowledge 


unknown 


probability 


known 


distribution known assumed 
p(9) interval @ € [min, max] fixed value @ 


process 


0 datum 6 o = o OO 


Fig. 2.1 Classifier using effect and probability to separate into stochastic uncertainty, incertitude 
and ignorance [8, 18] 


This matrix can be applied in all phases of the product life cycle, i.e. design, pro- 
duction and usage. This is even more important, since uncertainty quantification has 
become a thriving research field in engineering, computer science and mathematics 
over the last twenty years [20, 39]. 


Classification by effect and probability 


Fig. 2.1 shows the first classifier as a decision diagram. The first decision is whether 
the effect of an uncertain process property on the process or the structure’s function 
is known or unknown. This includes the decision of whether the effect on the system 
function and quality is known or unknown; recall that the system function is usu- 
ally represented as a constraint g(x) < O and quality is measured using effort F}, 
availability F> and acceptability F3, see Sect. 1.6. 

If the effect is unknown, we speak of ignorance. If the effect is known, then we 
speak of probability. The second question is whether the probability of the effect 
is known or unknown. If the probability of the effect is only partially quantified, 
we speak of incertitude. If the probability of the effect is sufficiently quantified, as 
shown schematically in Fig. 1.4, then we speak of stochastic uncertainty [8, 18]. 
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The category stochastic uncertainty implies that a probability density function 
of the process state as sketched in Fig. 1.4 is known. In this case, it is possible to 
describe, quantify and evaluate uncertainty. The category incertitude is very common 
in mechanical engineering. It is used for many processes in mass production and, 
for example, in the Austauschbau described by Franz Relaux in the year 1899 [47], 
i.e. a part A fits to a part B even though different people manufacture the two parts on 
different machines. The incertitude of the Austauschbau is mastered by measurement 
data from systematically drawn samples or by experience manifested in tolerance 
classes. The two categories stochastic uncertainty and incertitude lead to a non- 
deterministic system design whereas ignorance, i.e. disregarded uncertainty, implies 
a deterministic system design. 


Classification by data, component and structure 


The first classifier distinguishes between the effect and quantification of uncertainty. 
The second classifier is motivated by system design [42]. This classifier can best be 
understood by keeping in mind a physical system, such as one of the three demon- 
strators presented in Sect. 3.6, i.e. the lightweight structure MAFDS, the Active Air 
Spring and the 3D Servo Press, or the hydrostatic transmission as depicted in Fig. 1.7. 
A process chain, a system and a structure consist of components or individual pro- 
cesses that fulfil the sub-functions of a system. In the following, when mentioning a 
model and model uncertainty, we may refer to the model as the individual process 
or component of the system. However, we may also refer to the composed system 
satisfying one or more specific system functions g,. As pointed out in Chap. 1, dif- 
ferent systems may satisfy the same function. Some possible systems may not be 
evaluated. We call this nescience structural uncertainty. 

Applying the second classifier yields (a) data, (b) model and (c) structural uncer- 
tainty. These classes form the columns of Fig. 2.2. The first classifier shown in Fig. 2.1 
leads to the rows (i) stochastic uncertainty, (ii) incertitude and (iii) ignorance of the 
3 x 3 matrix shown. 

From top to bottom, the confidence in data, models and structures is decreasing. 
This distinction into different types of uncertainty in data, 1.e. data uncertainty, is then 
as follows. Data @ = 6 + 86 is subject to stochastic uncertainty if it can be modelled 
as realisations of a random variable with a distribution P(@) or density p(@) and 
expected value/mean 6. Incertitude appears if the data is only known to lie within a 
given fuzzy set or interval. If uncertainty of the data is not considered and thus ignored 
in the problem analysis, we speak of ignorance. For a more detailed discussion, see 
Sect. 2.1. 

For model uncertainty the classification is as follows: a validated and verified 
model is subject to quantified stochastic uncertainty. There is incertitude, as long as 
the model is only suspected, i.e. assumed without experimental evidence. If the model 
is unknown, this is called ignorance, consistent with the scheme shown in Fig. 1.5. The 
presented classification is supplemented by the required model characteristics given 
in Sect. 1.3; a model has the following three qualities here: consistency, correctness 
and conciseness, see Sect. 1.3. 
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Fig. 2.2 Classification of uncertainty into (i) stochastic uncertainty, (ii) incertitude, (iii) ignorance; 
and into a data, b model, ¢ structural uncertainty 


To represent specific components or systems, a model in implicit form 
f(u, y,z,m,...) = 0, (2.1) 


is used, where f is the model function, u are inputs, like control or boundary values, 
y are internal variables, such as states, z is the model’s output, i.e. the quantities of 
interest, and m are the model parameters which need to be calibrated. Sometimes u is 
split into binary design or other decision variables. In many cases, the above equation 
can be solved for given u and m such that y and z are uniquely determined. The 
model is then reduced to an explicit form. This often occurs if the model represents 
an input-output relation. 

As mentioned in Chap. 1, in engineering and natural sciences, exact models do not 
exist. Consequently, to represent reality, one can use a model discrepancy function 
öf(...) that captures the difference between reality and the model given by f. This 
leads to the “real” model 


f(u, y,z,m,...) + 8f(...) =0. (2.2) 
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Hence, öf is in most cases different from zero and its analytical expression is in 
general unknown. If öf can be modelled as a random variable, we consider it as 
stochastic model uncertainty. In this case, the distribution of öf depends on the 
parameters m and on additional prior assumptions. If a non-probabilistic approach 
is adopted to model the discrepancy function, then the min-max values of öf have 
a functional relation to the parameters m. If öf cannot be quantified, non-exactness 
is assumed and ignorance prevails, as pointed out in Chap. 1. For a more detailed 
discussion, we refer to Sect. 2.2. 

With respect to structural uncertainty, there are N > 1 competing structures S;, 
i=1,..., N, all satisfying the same specific system function gs within an accuracy 
interval g, — g = +6g. But the structures may differ in quality F. If the complete 
design specification is not explored, i.e. S A Sop we speak of ignored structural 
uncertainty. Structural uncertainty is discussed in more detail in Sect. 2.3. 


2.1 Data Uncertainty 
Sebastian Kersting, Roland Platz, Michael Kohler, and Tobias Melz 


In engineering sciences, generating and evaluating data for and from numerical sim- 
ulations, experimental tests of technical systems with high safety requirements, a 
representative process or archived data play an important role to adequately predict 
and evaluate the system’s performance, cf. Sect. 1.4. Data uncertainty is present, if 
the amount, type and distribution of required data, such as model parameters, is 
incomplete, unknown or insufficient; and in this context data quality as discussed in 
Sect. 1.4 is an important factor. This section clarifies the expression data uncertainty 
and classifies various approaches to describe different forms thereof. For the latter, 
a brief overview of probabilistic with further differentiation between frequentist and 
Bayesian inferences, and non-probabilistic, as well as parametric and non-parametric 
approaches to analyse data uncertainty is given. Following these approaches, the 
classification illustrated in Fig.2.1 into stochastic data uncertainty and incertitude 
is discussed in this section. 


2.1.1 Introduction 


Within this book, we distinguish between two general types of data: model parame- 
ters m and state variables u and z that have a quantifiable value. Model parameters 
describe the technical system’s characteristics, such as geometrical and material prop- 
erties for a mathematical or computer model, e.g. length or width of a beam element 
and mass, Young’s modulus, etc. Aggregating geometrical and material properties of 
one or multiple components that effect processes in a system or structure may lead to 
new model parameter expressions like stiffness or damping as important quantities in 
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the system’s computer models for load-bearing systems. The models relate to them 
in a mathematical way and model uncertainty may become relevant, see Sect. 2.2. 
State variables describe the input and output conditions, such as mechanical loading, 
stress and strain, displacement, velocity, acceleration etc. They are mathematically 
related to the model parameters via the models. 

On the one hand, model parameters m and state variables u are the input data for 
numerical simulations with computer models for predicting the system’s behaviour, 
for example the dynamic behaviour of a structure due to vibrational excitation. They 
are also the input quantities for the experimental tests to validate the prediction. 
On the other hand, the system’s behaviour as the output z of both simulation and 
test are mostly state variables or other measured quantities that can be inferred 
from model parameters by mathematical conversions. For example, the measure- 
ment of a lateral force and a resulting lateral deflection of a beam element leads to its 
stiffness. 

Data in form of model parameters or state variables may have a single or a dis- 
tributed value. Both are subject to uncertainty. Single or distributed values may vary 
in many possible ways depending on the designer’s knowledge about the data and 
other conditions that make them uncertain. For example, a model parameter, such 
as the length of a beam element, may vary due to production tolerances, which 
influences the output in computer simulations or experimental tests. 

In general, two basic types of data uncertainty occur: aleatoric or epistemic 
data uncertainty. Aleatoric uncertainty [67] is also known as irreducible uncer- 
tainty [62] or variability [67]. It is objective [32], and mostly characterised by a 
probabilistic distribution function. In [7], it is presumed to be the intrinsic random- 
ness of a phenomenon. Epistemic uncertainty is also known as reducible uncertainty 
[50, 62], ignorance uncertainty [50], or simply uncertainty [67]. It is reducible [62], 
subjective [32], and occurs due to a lack of knowledge [62], insufficient or incom- 
plete data [7]. Both types of uncertainty may be described via probabilistic and 
non-probabilistic approaches, cf. [33, 38, 44]. The probabilistic approaches can be 
further divided into parametric, with frequentist or Bayesisan inference approaches, 
or non-parametric. 

Taking into account aleatoric and epistemic data uncertainty, this book distin- 
guishes between stochastic data uncertainty and incertitude. They depend on the 
knowledge and assumptions about the data distribution and are explained in the 
following. 


2.1.2 Stochastic Data Uncertainty 


We assume that data is subject to stochastic uncertainty, if it can be modelled as 
realisations of a random variable © with a distribution P(@). In this case, a para- 
metric Or anon-parametric approach as well as a frequentist or a Bayesian inference 
approach may be used to approximate the distribution for further uncertainty analy- 
sis. The approaches highly depend on the knowledge about the data, e.g. if a sample 
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of measured data exists and, if applicable, its sample size. All approaches to anal- 
yse stochastic data uncertainty are conducted under the assumption that an event is 
possible with a given probability [33]. 

In the parametric approach, one assumes that the underlying distribution depends 
on finite dimensional parameters that fully describe the distribution P(@). In case 
of measuring errors or production tolerances, a typical choice would be a normal 
distribution. Here the distribution of a random variable © is uniquely identified by the 
parameters mean ĝ and standard deviation ø (9). If the distribution is incomplete or no 
samples are available, engineering or physical knowledge can be used to approximate 
the parameters. Otherwise, if an adequate sample is on hand, a maximum likelihood 
estimator can be applied to estimate the distribution parameters, cf. [21]. 

In the non-parametric approach, the description of distributions is based solely on 
observations, cf. [57, Chap. 4.8]. The underlying distribution does not need specific 
finite dimensional parameters. Instead, e.g. a kernel density estimator can be applied 
to estimate the corresponding probability density function p(@) of P(@), cf. [43, 
49]. In most cases, if only a relatively small sample with less than 50 data points 
is available, the maximum-likelihood approach yields more adequate results with 
respect to high convergence than the kernel density estimator—if the distribution 
assumption is correct. However, the actual sample size needed to achieve sufficient 
results may vary and depends on the specific application. 

If the distribution of input data is known or estimated as described above, several 
methods may be used for a probabilistic computer simulation for obtaining its proba- 
bilistic output prediction, e.g. Monte Carlo Simulation (MCS) methods as described 
in [5, 10, 15, 39, 41, 51, 54]. 

MCS methods depend on the selected inference approach, meaning that output 
data distributions may vary from a frequentist or Bayesian perspective. They differ 
in the underlying assumptions made regarding the nature of data distributions [57]. 
In the frequentist view, probabilities are defined as the frequency that an event occurs 
if an experiment is repeated a large number of times. The Bayesian perspective treats 
probabilities as a distribution of subjective values based on prior knowledge and 
assumptions. They are constructed or updated as data is observed; algorithms are, 
e.g. Markov Chain Monte Carlo Techniques, Metropolis-Hastings Algorithms etc., 
see [57]. Bayesian inference-based approaches are mainly used for model parameter 
calibration and to determine model uncertainty, see Sects. 2.2, 4.1 and 4.3. How- 
ever, they are computationally demanding because of the need to infer the posterior 
distributions of each parameter [9]. 


2.1.3 Incertitude 


We say that data is subject to incertitude, if it can not be modelled as realisations 
of © with a distribution P (9). The distribution of the input data is unknown. Instead, 
the analysis may be conducted based on fuzzy set theory or direct interval analysis 
that provide information about the possibility that a certain data value lies between 
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a minimum and a maximum. These possibilistic approaches, in contrast to proba- 
bilistic approaches to assess stochastic data uncertainty, basically analyse whether 
an event is possible or impossible [33]. They are explained briefly in the following. 


Fuzzy data uncertainty 


The fuzzy set theory was introduced by Zadeh in 1965 [66]. Since then, numerous sub- 
domains like fuzzy logic, fuzzy modelling, fuzzy arithmetic etc. have emerged [19]. 
Within the Fuzzy framework, data is expressed as member elements of a set A. 
They can be defined by using a characteristic or, respectively, membership func- 
tion ua: A — [0, 1]. A membership of an element x is given if ua(x) = 1, non- 
membership if wa(x) = 0, [19]. The membership functions vary in form, they can be 
triangular, Gaussian, exponential etc. A practical way is to use so called &-cuts that 
divide the membership function into intervals with the aim to determine possibilities 
that a value is inside the interval, [33]. An overview of fuzzy methods for data uncer- 
tainty analysis in engineering applications is given in [48], applied fuzzy arithmetic 
can be found in [19] and fuzzy set theory based on fuzzy arithmetic is discussed 
in [66]. However, due to the absence of a structured and systematic elaboration of 
the theory, only a few practical approaches have been conducted [19]. 


Interval based data uncertainty 


If neither distribution nor membership functions are available to describe the occur- 
rence of data, an interval based approach may be useful. In this case, it is commonly 
assumed that the uncertain data lies between a minimum and a maximum value. 
Using a pessimistic perspective, a worst-case scenario is then the object of further 
investigations. Each parameter interval consists of a pair of min/max values, the four 
basic computation rules for adding, subtracting, multiplying, and dividing are valid 
for each interval parameter. However, the quality of the direct interval arithmetic 
evaluation depends on how often the interval parameters are present in a governing 
function of the deterministic computer model, i.e. the intervals become larger when 
they are propagated. Moreover, building a computer model with interval parameters 
that include paired min/max values can be demanding and time-consuming. Also, the 
analysis tends to overestimate uncertainty by using only extreme values that occur 
only rarely within the interval arithmetic [1]. 

Intervals can be stochastically motivated, e.g. 6 + 3 0 (6)?-intervals specify min- 
imum and maximum values, if a normal distribution of data is assumed. Eventually, 
possibilistic methods can be applied as shown in [1, 40]. 

In higher dimensions and to avoid using extreme values that lead to overestimation, 
the limiting intervals are typically replaced by ellipsoids for which the worst-case 
analysis becomes more complicated. For example and as shown in [11, 28-30, 55], 
sophisticated optimisation techniques introducing uncertainty sets are necessary to 
master data uncertainty in this pessimistic setting, see also Sect. 6.1. 
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2.2 Model Uncertainty 
Alexander Matei, Roland Platz, Stefan Ulbrich, and Maximilian Schaeffner 


In science and technology, mathematical models are frequently employed for the 
explanation of natural phenomena and for the description, quantification and control 
of engineering processes. We specifically focus on mathematical models and their 
accuracy, for other types of models we refer to Chap. 1. We do so because mathemat- 
ical models enable numerical simulations to predict the behaviour, outcome or result 
of real technical products, systems and processes along their life cycle, see Sect. 1.2. 
However, it is a common observation that the usage of these models is affected by 
uncertainty, which can be traced back to the system design phase. Several causes can 
be identified for this uncertainty in early stage product development and, particu- 
larly, in the mathematical modelling. Our ignorance about the physical behaviour of 
a technical system leads to models that are only approximations of reality and may 
only be valid for a particular range of inputs and parameters, cf. Fig. 1.5. 

There are two categories of ignorance which we briefly want to mention. The first 
is called lack of knowledge and stands for objects or processes which are unknown, 
unfamiliar and nameless to us. Examples for lack of knowledge arise whenever a 
novel material is exposed to new circumstances. Its reaction to the environment, its 
behaviour under load or pressure and its wear, all of which needs to be observed, eval- 
uated and generalised. This is a challenge to scientists and engineers alike. The second 
category comprises effects that are known to us, but they are neglected, ignored and 
kept out of consideration in the modelling. We call it disregard of knowledge. To give 
an example, one may think of a linear elastic spring under load where the deforma- 
tion of the spring is proportional to the loading force, only if the latter stays below 
a certain threshold. For loads above this limit, the spring material shows nonlinear, 
plastic or hysteresis-type behaviour which is difficult to model and thus it is often 
neglected. 

Another source of model uncertainty arises from the numerical approach used 
to discretise such equations that are impossible to solve analytically. In engineer- 
ing applications, the finite element method is a common numerical approximation 
scheme. In most cases, uncertainty caused by the numerical discretisation with finite 
elements can not only be quantified but also mastered by standard approaches, e.g. by 
developing error estimates [46]. In most cases, numerical errors happen on a rela- 
tively small scale, whereas the more severe sources of model uncertainty are missing 
or incomplete physical or empirical relations. In addition, human factors also con- 
tribute to model uncertainty. The methods and technologies to detect, quantify and 
master model uncertainty, which are presented in this book, see Sect. 4.3, are gener- 
ally applicable, irrespective of the above mentioned causes. 

Model uncertainty exists, if the functional relations between input and output, 
model parameters and other internal variables, as well as the scope and complexity 
of the model, are unknown, incomplete, inadequate or unreasonable. The dilemma 
the designer encounters is that in early stage design, before calibration, verification 
and validation processes start, the extent of uncertainty is difficult to detect. Even in 
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the usage phase, after the final product has been assembled, a degree of uncertainty 
remains, since the full-scale product does not exactly match the small-scale prototype, 
neither does the computer model. Various mathematical approaches using different 
prior knowledge about functional relations, scope and complexity as well as the 
required data, which can be uncertain as well, have been developed to deal with 
model uncertainty. 

Itis one aim of this book to understand and to evaluate the uncertainty especially in 
load-bearing mechanical systems with high safety requirements. This section gives 
a brief overview of different approaches to describe, quantify and master model 
uncertainty. In this context, the term ‘master’ means to be aware and to be able to 
quantify model uncertainty in verification and validation processes, e.g. by data-based 
training. This leads to an adapted mathematical model that, eventually, adequately 
describes and predicts the system and process behaviour observed in reality. 


2.2.1 Functional Relations, Scope and Complexity 
of Mathematical Models 


In this chapter, we consider models as images of reality in the domain of mathematical 
abstraction. These mappings describe or represent knowledge about a system in the 
language of functional relations given in implicit form 


fu, y,z,m) =0 (2.3) 


between input u and output data z, model parameters m, such as material properties, 
and internal variables y, like states. Accordingly, we mean by model uncertainty that 
these images of reality are imperfect, i.e. the governing physical relations f between 
inputs, outputs, parameters and internal variables are unknown or incomplete, or 
they are partly reduced to physically-inconsistent approximations (Sect. 1.3) of more 
complex, but expensive, expressions. Thus, in the presence of model uncertainty, 
Eq. (2.3) does not reflect reality. A common representation of model uncertainty 
introduces a model discrepancy function öf which accounts for lack or disregard of 
knowledge, numerical errors and human factors in the mathematical modelling as 
mentioned before. The “real” functional relation is then considered to be implicitly 
given by 


f(u, y, z,m) + of(...) =0. (2.4) 


In many cases, for given u and m, the implicit equation (2.3) is solved to obtain the 
model’s output z explicitly. If the model function f is differentiable and its derivative 
is invertible with respect to the internal variables y, then the implicit function theorem 
yields a reduced model n that represents an input-output relation to the quantity of 
interest z. The model equation can now be written in explicit form 
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nu, m) = z, (2.5) 


and likewise for the case where the model discrepancy function is added, cf. Eq. (2.4). 
In the sequel, we follow the main literature on this topic that considers only computer 
models 7, i.e. reduced models, which describe an input-output relation. 

Evidently, different assumptions about functional relations like axiomatic or 
empirical, linear or non-linear, and time-invariant or time-variant alter the output 
of the model significantly [37]. Moreover, the model’s scope and complexity can be 
varied. Thus, any computer simulation that is based upon uncertain models leads to 
erroneous predictions of the quantity of interest that affect the verification and valida- 
tion process necessary to prove the model’s consistency and correctness, cf. Sect. 1.3. 

The designer has several options to choose from possible modelling assumptions 
about functional relations, as well as scope and complexity, as mentioned above. 
When a mathematical model has been built, the functional relations are subject to a 
verification and calibration process to prove and to update the numerical simulation, 
the computer code and, if applicable, the model parameters [2]. Eventually, the com- 
puter model is validated against experimental tests of a real system, like the Modular 
Active Spring-Damper System, see Sect.3.6.1. As for the scope and complexity, 
the number of degrees of freedom can be high and costly depending on the form 
and discretisation of the model, e.g. analytical, finite elements or multi-body-models 
that also influence the results of verification, calibration and validation processes. 
Furthermore, Occam’s razor can be used as a guiding principle to keep models as 
simple as possible, see Sect. 1.3, because more complex models often tend to be more 
susceptible to uncertainty. 

The functional relations as well as the scope and complexity of models are consid- 
ered as being independent from how model parameters and input data are present—as 
a simple value, randomly distributed or as intervals. These are subject to data uncer- 
tainty, which is covered in Sect. 2.1. 


2.2.2 Approaches to Detect, Quantify, and Master Model 
Uncertainty 


Basically, two different approaches give information about detectable, quantifi- 
able and masterable model uncertainty: a deterministic analysis and a probabilistic 
frequentist or probabilistic Bayesian inference-based perspective. The latter needs 
subjective prior data distribution information as discussed in Sect. 2.1. The determin- 
istic and Bayesian inference-based approach allow data-based training, which is an 
important criterion for the verification and validation processes. However, finding 
the adequate correction terms or prior information, especially for models with high 
complexity, remains a challenge [9]. Using a probabilistic frequentist approach, see 
Sect. 2.1, however, does not take into account prior information other than random- 
ness of data. 
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In accordance to this book’s notation, deterministic approaches do not master 
stochastic uncertainty in a mathematical model. However, they may be suited to 
quantify and master incertitude, e.g. when only extreme values like minima and 
maxima are known or assumed, or when parts of a model are missing to detect igno- 
rance, cf. Fig.2.2. Probabilistic approaches, however, describe and master all three 
types of uncertainty. In the following, we give an overview of the two approaches. 


Deterministic framework 


On the one hand, a deterministic analysis can be used, for example, in fault diag- 
nosis [56] to quantify uncertainty in the model equations. To do so, the model is 
adjusted by a model discrepancy function ön which is assumed to stay within a 
bounded uncertainty set 4,: 


n(u,m) + dn(u) =z, ôn €Un. (2.6) 


A standard residual analysis then enables the engineer to distinguish component 
failures from the effects of model uncertainty. However, this method strongly relies 
on the assumption that the model discrepancy function 57 stays within a bounded 
uncertainty set U}. 

On the other hand, a deterministic analysis may be used in model verification and 
validation processes. In [9, 57], the possibility to approximate the residual between 
the model output and the observed quantity of interest via a polynomial p is men- 
tioned. In this case, the polynomial p takes the role of the discrepancy function: 


n(u,m) + p(u,m,0) = z. (2.7) 


This necessarily leads to an augmented parameter set (m, 0) consisting of the original 
physical axiomatic and empiric parameters m as well as the non-physical polyno- 
mial parameters 0, which do not give an enhanced physics-based understanding of the 
model’s uncertainty or shortcoming in predicting reality [9]. The augmented param- 
eter set needs to be calibrated, which is usually performed by an optimisation scheme. 


Probabilistic framework 


Within the probabilistic framework, Bayesian inference-based approaches are fre- 
quently used to assess the prediction quality of a mathematical model under given 
experimental data [9, 16, 52, 61]. In [34] or [37], Bayesian calibration techniques 
and a plausibility prior argument are used for model selection. Another important 
approach introduces a stochastic process ô for the discrepancy function [22]: 
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n(u,m)+d(u,m, od) +e =2Z, (2.8) 


where € is stochastic noise, usually produced by the measurement error, and @ are 
hyperparameters, which need to be tuned by an optimisation scheme. Based on this 
setting, [64] introduce a technique for model validation. A method designed for time- 
dependent systems is proposed in [3]. Combinations of a high- and a low-fidelity 
model and experimental data are used to construct a multi-fidelity model, which is 
proposed in [13] as an improved predictor. A scaled Gaussian Process is used in [17] 
for model calibration and prediction. It is claimed that the method bridges the gap 
between the least-squares calibration and the Gaussian Process calibration and, thus, 
is an improvement of the method introduced in [22]. Furthermore, a Bayesian interval 
hypotheses-based approach [36] and a Bayesian inference-based approach [37] are 
used to compare different models based on their internal functional relations from 
axiomatic or empiric assumptions, see also Sect.4.3.3 for assessing model uncer- 
tainty in the Modular Active Spring-Damper System, see Sect. 3.6.1. 

In order to apply the Bayesian methods, it is necessary to select prior distributions. 
Often, this is subjective and it is unclear how to choose them, which may lead to 
unrealistic assumptions. Furthermore, it is pointed out in [60] that the approach 
in [22] may lead to inadequate results in case of an imperfect computer model. As a 
consequence, further verification of the computer codes needs to be conducted. 

From the frequentist’s perspective, a simple approach to quantify model uncer- 
tainty is to use validation metrics, such as the area validation metric [35] or the Maha- 
lanobis distance [68]. They give a quantitative measure of disagreement between the 
model output and the observed quantity of interest based upon observed measure- 
ments. In order to select the most adequate model, an arbitrary threshold on the metric 
is imposed, or classical hypothesis testing is performed. Surrogate models are often 
used to quantify the uncertainty in a technical system. Usually, these methods use 
computer simulations and a small sample of experimental data to estimate properties 
of probability distributions, such as quantiles [25-27] or densities [14, 23, 24]. A 
detailed description for a method based on an imperfect computer model is given in 
Sect. 4.3.8. A case where computer models are assumed to fit the reality is shown in 
Sect. 5.2.6. In [12], another method to detect model uncertainty is proposed which is 
based on optimum experimental design and hypothesis testing, see also Sect. 4.3.1. 
In [65], another approach to quantify the model error is developed. Here, the model 
discrepancy function is estimated on bootstrap samples via a regression estimation, 
e.g. smoothing splines or artificial neural networks. 

However, the application of frequentist methods often demands a larger sample 
size, which can become a problem, since generating data is an expensive and time- 
consuming process. 
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2.3 Structural Uncertainty 
Peter F. Pelz and Marc E. Pfetsch 


Besides data and model uncertainty introduced in Sects. 2.1 and 2.2, structural uncer- 
tainty forms the third important pillar of uncertainty under consideration in this book. 
Structural uncertainty refers to the fact that only part of the possible solutions are 
evaluated with respect to uncertainty. In this sense, the model of the system is incom- 
plete. However, the focus is on the system and not on the ignorance of the models of 
the system components, as in model uncertainty. 

Let us start with the viewpoint of classical product design. Given a requested 
system function, the designer plans the system structure. The systems are assembled 
by components and modules, which then form the system. In production, this arises 
when combining single processes to process chains. When a given system function 
can be generated by a multitude of different function structures, and each function 
structure can be generated by a multitude of elements, this results in a “combina- 
torial explosion” of possibilities that, in general, cannot be evaluated by humans 
anymore. This lack of knowledge on other possibilities is then called structural 
uncertainty. 

The consideration of this type of uncertainty seems to be new, but the term “struc- 
tural uncertainty” is sometimes used in the sense of “model structure uncertainty”, 
i.e. the structure of the model is uncertain. Some examples from different disciplines 
can be found in [4, 6, 58, 59]. In our book, the latter meaning is captured by the term 
“model uncertainty”, see Sect. 2.2. 

In comparison to data and model uncertainty, structural uncertainty has the advan- 
tage that its presence has no direct negative effect on product safety. However, eco- 
nomically better solutions might be lost. 

Structural uncertainty can be tackled by using (discrete) mathematical optimisa- 
tion methods that allow to consider all possibilities and select the best system choice 
with respect to a predefined objective function. These techniques require a combina- 
tion of domain knowledge in order to set up a physical model and define the allowed 
elements. This is then integrated into a mathematical optimisation model, which is 
solved using optimisation software. As usual, one needs to balance the exactness 
of the model with the effort to obtain optimal solutions; see Sect. 1.3 for a general 
discussion of this balance. Often tailored solution methods need to be developed in 
order to achieve practically feasible solution times. The method for the quantification 
of structural uncertainty is therefore highly context-dependent. 

This book contains examples that illustrate this approach, see, for example, 
Sects. 1.5 and 6.3.5. Many more examples can be found in the literature, e.g. [31, 
45, 53, 63]. These examples show the flexibility of mathematical programming to 
deal with different manifestations of structural uncertainty. Nevertheless, currently, 
expert knowledge is needed to derive and efficiently solve appropriate models of 
reality. 

Structural uncertainty has two other aspects that we want to briefly mention. 
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When using models in order to compose a system, the model predetermines the 
possible components that can be chosen, i.e. the model can only be optimised 
over its model horizon, see Sect. 1.3. Again, possible interesting solutions might 
be lost due to the choice of the model. One needs to be aware of this restriction, 
similar to the fact that models are always an approximation of reality. 

The first aspect arises from the fact that the system is built from smaller elements. 
However, a quantitative evaluation of uncertainty usually only takes place on the 
level of the single elements, since an analysis for the complete system would 
be too complex or taking measurements would be too expensive. This book dis- 
cusses several methods to deal with this uncertainty. For instance, a common way 
to handle the corresponding uncertainty is by flexibility, see Sect.6.2. Another 
method is to make the system robust or to consider the effect of uncertain param- 
eters already in the mathematical model and perform a robust optimisation, see 
Sect. 6.1. 
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Abstract This chapter serves as an introduction to the main topic of this book, 
namely to master uncertainty in technical systems. First, the difference of our 
approach to previous ones is highlighted. We then discuss process chains as an impor- 
tant type of technical systems, in which uncertainty propagates along the chain. 
Five different approaches to master uncertainty in process chains are presented: 
uncertainty identification, uncertainty propagation, robust optimisation, sensitivity 
analysis and model adaption. The influence of the process on uncertainty and meth- 
ods depends on whether it is dynamic/time-varying and/or active. This brings us to 
the main strategies for mastering uncertainty: robustness, flexibility and resilience. 
Finally, three different concrete technical systems that are used to demonstrate our 
methods are presented. 


How can we ensure product safety, realise lightweight structures, enable sustainable 
systems or control production quality? All these questions lead to the issue of how 
to master uncertainty, cf. Chap. 1. The answer to this core issue has many different 
facets, and there is a need to structure the topic and demonstrate solution methods. 

This chapter is dedicated to structuring the facets, but also to introducing our 
specific approach to mastering uncertainty. For this purpose, we introduce process 
chains and temporal characteristics of processes. Often, active processes seem to be 
a smart way to cope with uncertainty. We compare the cost benefit associated with 
the selection of active processes. 
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The three strategies, (i) robustness, (ii) flexibility, (iii) resilience, are of particular 
interest when it comes to mastering uncertainty. In this chapter we introduce these 
and distinguish between the three strategies. Finally, to demonstrate and validate our 
specific approach, we define three demonstrator systems in the last section of this 
chapter. 


3.1 Beyond Existing Approaches 
Peter F. Pelz 


Uncertainty quantification is a large research field today. It is the basis for machine 
learning and inference in the context of data-driven, i.e. black box models, cf. Chap. 1. 
Uncertainty quantification inevitably deals with model uncertainty and data uncer- 
tainty. Grey box models become more and more important in mechanical engineering, 
where prior knowledge is available. 

Our research from the perspective of mechanical engineering has three aspects 
that go beyond the field of uncertainty quantification: 


(i) Firstly, we focus on physical systems that are designed, manufactured and used. 
The materiality of the systems and the physicality of their use inevitably lead 
to new aspects in the mastering of uncertainty. One example is the mastering 
of uncertainty across all product life phases and the concept of closed loops 
between phases, Fig. 3.1. Another example is the consideration of the functional 
safety of physical systems. 

(ii) Secondly, the decomposition into sub-functions and the assignment of real pro- 
cesses or components to the sub-functions, typical for mechanical engineer- 
ing [36], is a guiding principle for us, which is reflected in the uncertainty clas- 
sification given in Chap. 2. It leads us to the concept of structural uncertainty. 
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Fig. 3.1 A product or system design, B production, C usage; all phases are interconnected by the 
flow of material and physical products as well as data, information and money 
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But the systematic engineering design view also leads us to the conflicting 
objectives minimum effort, maximum availability and maximum acceptability. 
This view results in the broad motivation of mastering uncertainty. It is a basic 
approach to gain product safety, lightweight structures, sustainable systems and 
closed-loop production quality control, Chap. 1. 

(iii) Thirdly, and most importantly in our view, we focus on mastering uncertainty; 
quantifying it may be a prerequisite. As a result, we put strategies for uncertainty 
management on the top level. Some of these strategies require new active or 
semi-active technologies that enable adaptation to changes in production or 
usage. Here, too, we extend the current state of science and technology by our 
contribution. 


View from different disciplines 


In the twelve years of research that form the foundation of this book, there has been 
continuous inspiration between the various disciplines. Thus, the framework struc- 
ture outlined in Fig. 1.12 can be viewed equally from the perspectives of mechanical 
engineering, mathematics or law. As shown in the introduction, for example, Sus- 
tainable Systems Design can be complementarily presented from the perspectives 
of systematic engineering design or mathematics. We regard the different forms of 
representation in ‘languages’ and types rather as a benefit than a disadvantage. This 
viewpoint is represented throughout this book. 


3.2 Uncertainty Propagation Through Process Chains 
Peter F. Pelz 


We consider process chains, systems and structures in all product life phases in view, 
cf. Fig. 3.1. Therefore, it is obvious that we need an abstract representation in mind 
on how to treat those chains in a generic way. Figure 3.2 shows the model of a generic 
process chain being composed of single processes. 


Representation of process chains 


In Fig. 3.2 the physical product or system moves from left to right through the pro- 
cess chain, or the system or product is represented by the process chain itself. The 
evolution of the density function p(@) of the product or system feature 0 = 6 + 60 
along the process chain is shown. In each process, energy, material and information 
are fed into or are withdrawn from the product. This is done by the work equipment, 
a generic term for man or machine. This incorporates tools such as sensors, actua- 
tors, controllers, and equally energy transformers and storage devices, i.e. capacities. 
Such a process may be active or semi-active, transient or quasi-stationary; it may 
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Fig. 3.2 Model of a generic process chain 


be a static process, a relaxation process or a dynamic process. The different process 
characteristics will be discussed in Sect. 3.4. 

In Chap. 1 we introduced engineering design thinking of structures built from 
components. This engineering design is represented by the generic process chain 
but also the branched structure or process chain depicted in Fig.3.3. To model the 
general linkage of single processes, serial or parallel, the multi-pole presentation has 
spread [31]. The multi-pole representation is an object-oriented modelling approach. 
The representation is used in many domains, e.g. acoustics, electrical engineering, 
structural mechanics or fluid power. Other multi-domain model tools such as the 
bond graphs or Modelica are based on multi-pole representations. 

Each component, i.e. each individual process, is easily modelled by a transfer 
matrix Aı,..., Ay with nonlinear algebraic entries. Using a multi-pole represen- 
tation, the input data 6, of the kth process are mapped to the output data 0,41: 
6; = AxOx41. Even though the reverse representation is often given, this represen- 
tation is more concise when it comes to process chains. In a dynamical setting, 
the transfer matrices A, may be given in the frequency domain. With a parallel 
arrangement of N components, the total transfer matrix is obtained by the sum of 
the individual matrices (i for input, o for output) 
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Fig. 3.3 a Multi-pole representation of a system or process chain; b parallel arrangement; ¢ serial 
arrangement 


With a serial arrangement of M components, the total transfer matrix is gained by 
the product of the individual matrices, 


M 
b= bo | | Ar. 
k=1 


Therefore, the model of the structure or the branched process chain can be easily 
assembled from the component models. Thus a model is available, which serves as 
a prerequisite for an uncertainty analysis or uncertainty propagation. 


Uncertainty propagation 


The process chains sketched in Figs. 3.2 and 3.3 help us to picture uncertainty prop- 
agation. The methods used in this book for uncertainty propagation are (i) moment 
methods and (ii) Monte Carlo simulations (MCS), cf. Sect. 2.1. The moment methods 
are the simplest and most commonly used methods. However, they are less powerful 
than the Monte Carlo methods. The latter are suitable in the preliminary design phase 
when compact, coarse granular models are used. In the later design stage, however, 
brute-force methods like MCS are often too expensive in terms of computing time. 

In the following, we will shed some light on the Gaussian uncertainty propagation. 
This moment method is the most common one used by engineers, and it is worthwhile 
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to point out the conditions to be met when using this method. The experienced reader 
might skip the following section in small font. The case study presented in this section 
uses MCS in a preliminary design phase. 


For the moment method, to be concise, we present the case of two processes 1 and 2 that are 
combined to an output 63 = 0 = h(#1, 02). The density function of p(@) of the product or system 
feature 6 is given by Sivia and Skilling [49] 


oo oo oo oD 
p(0) = 1 / (01, 02, 8) d0,d = i f POL, 0518 — h01, 62)] 4040. 
0 0 0 0 


This generalised convolution integral reads as follows: the density distribution function p(0) of the 
process chain’s output 0 = A(01, 02) is the integration of the joint density function p(01, 02) along 
the contour line 0 = h(61, 02). We consider the following important in the special case (i) and the 
general case (ii): 


(i) additive processes 6 = 6; + 62, 
(ii) Gaussian error propagation for 0 = h(6}, 62). 


Firstly (i), additive processes with 0 = 0; + 62 are widely used in mechanical engineering. One 
example of an additive process is the mounting of two bars each having a length 6; and 92 respec- 
tively. We may equally think of the mounting of two springs in parallel or two compliances in series. 
In the first case 04 2 denotes the spring’s stiffness. In the latter 0; 2 characterises the inverse stiff- 
ness, i.e. the compliance. We may even conceive a flow process in chemical engineering, mobility 
research or logistics. In this case 04 2 denotes the residence time within each individual process and 
0 the resulting residence time. 

Inserting A(01, 62) = 01 + 42 into the generalised convolution integral using the product rule 
p(01, 62) = pı(01)p2(02) for statistically independent processes, yields the convolution integral 
for the additive process chain 


p(0) -f pı(0ı)p2(0 — 01) doy. 


The density functions are normalised, i.e. the zero moment equals one. The first moment is the 
mean or expected value, the second central moment is the variance: 


a= f 6 p(6) dd, as} O-ro = | (60)? p(0) d0. 
0 0 0 


Using the convolution to express p(0) in the two definitions for the mean and variance yields for 
additive processes the well-known result 


0 =8 +b, P =o } oz. 


The derivation does not rely on Gaussian density functions, i.e. the result is exact for arbitrary density 
functions. The generalisation for more than two individual processes reads 9 = J 0z, 07 = > oe 

Recall the example of two assembled bars; it is trivial that the mean value of the total length is 
the sum of the mean values of the components. But also the variance of the length of the overall 
structure is the sum of the variances of the bars. For two flow processes in serial connection, the 
mean value of the total residence time is the sum of the mean residence times within the individual 
processes. Diffusive mixing can cause a sharp front to blur. Due to the linearity of the diffusive 
transport, the variance of the signal at the output is equal to the sum of the variances of the two 
individual processes. 

The mentioned flow process is a nice visual model for the propagation of uncertainty in additive 
processes. This is due to the fact that the density distribution at the outlet p(@) can be measured 
as a change in concentration over time in a single experiment: assume we would add N objects 
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(molecules, ...) in an arbitrarily short time at a time ¢ = 0 into a constant flow Q. If the process has 
the volume V, then we measure the temporal change of the concentration given by N/(Vr) p(t) at 
the process output. Here, 7 is the mean residence time given by f = V/Q. As always, things become 
clearer in a dimensionless representation: if we measure time in multiples of the mean residence 
time, i.e. b=}, and concentration c in multiples of the typical concentration N/V, we measure 
ô(0) > p(0), i.e. a Gaussian normal distribution for a purely diffusive process centred at 0 = 1. In 
a real experiment it is not possible to realise a Dirac delta function ô(0) but it is easy to realise a 
Heaviside function H(0). This is achieved by changing the concentration at the inlet at a time 0 = 0 
suddenly from zero to one. In practice this means switching a valve. At the process outlet we then 
measure the cumulative density function H(@) > P(@) = E p(r)dr. 

Secondly (ii), in the general case, the dependent variable 0 is a nonlinear function of one, two 
or more independent variables 6 = h(#ı, 62). A perturbation of h at the operation point (010, 90) 
marked by the index 0 is given by 


h 
o 2 


ah 
h = ho 4 
j f 30> 


502 + O(667). 
D0, 2 (60°) 


0 


Inserting this perturbation into the general convolution integral and neglecting terms of the order 
of magnitude O(667) yields the Gaussian uncertainty propagation [29] 
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The index g indicates the Gaussian approximation of the variance. Here, 


oo oo 
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denotes the co-variance of the two independent variables. 


The Gaussian uncertainty propagation is the simplest and most commonly used 
method of uncertainty propagation, but it is rarely critically questioned. From the 
derivation it is clear that the trust into the method should decrease with increasing 
nonlinearity in A(01, 02). This becomes clear for the simpler case 0 = h (01). This 
coordinate transformation shown in Fig. 3.4b leads to a distortion of a symmetric input 
density function pı (01) > p(0). As a result, the mean 0 = i h(8,) pi (01) dé, dif- 
fers from the approximation 0, = h(010) and further o? is only an approximation 
of o?, Fig. 3.4b. In summary we recognise that the usage of the Gaussian approxi- 
mation (56)? ~ (50); =) (204)? (Ox)? for uncorrelated input data 0, needs some 
justification. 

For the strongly nonlinear process chain being treated in the following Sect. 3.3, 
the moment method, i.e. the Gaussian uncertainty propagation is not adequate. In 
Sect.3.3 we use the bootstrapping method [10]. Other methods and examples for 
uncertainty propagation are found in Sect. 6.1.6. 
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Fig. 3.4 a Gaussian uncertainty propagation shown to be associated to a coordinate transformation 
or mapping 6; —> 0 = h(6)); b approximation 0, ~ 0 due to the nonlinearity in h(01) 


3.3 Five Complementary Methods for Mastering 
Uncertainty in Process Chains 


Peter F. Pelz 


In Sect. 3.2 we applied moment methods of uncertainty propagation to process chains. 
In several parts of the book we resume these and use more in-depth methods of 
uncertainty propagation, cf. Sect.6.1.6. Uncertainty quantification includes uncer- 
tainty propagation [30]. Uncertainty propagation is often recognised as uncertainty 
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analysis. However, it is only one of at least five methods that form a complementary 
toolbox for the mastering of uncertainty in mechanical engineering. 

We will discuss the five methods of the toolbox from the perspective of Sustainable 
Systems Design, which was presented in Chap. 1: the shift to the new paradigm 
‘optimal quality subject to functionality’ combines the two incomplete paradigms 
‘form follows function’ (Sullivan) [51] and ‘less but better’ (Rams) [42]. The quality 
F = {F\, Fo, F3} is represented by (i) the effort F; to manufacture and operate the 
system, (ii) the availability F> of the system, as well as (iii) the acceptability F3 of the 
system by the user and the society. The functionality is represented by the system’s 
functions, which are represented by a subset of the constraints, g(x) < 0. Here, 
functional quality is one aspect of acceptability and is measured by the deviation ög 
from the customer expectation given by the specifications g,. The lower the loss in 
functional quality dg, the higher the acceptability. 

In summary, this understanding of the interplay between function and quality as 
described here as well as in Sect. 1.7 and Fig. 3.5 is more general than the understand- 
ing in the concept of Robust Design [41]. With Robust Design, firstly, effort is mea- 
sured in costs, secondly, availability is understood as part of the function, and thirdly, 
the only measure for acceptability is functional quality. As pointed out in Sect. 1.7, 
the more general understanding of function and quality allows the mapping of Sus- 
tainable Systems Design to a constrained optimisation problem, provided the metrics 
for effort F;, availability Fy and acceptability F3 are well defined, cf. Fig. 1.10. 

In this section, we will introduce the methodological building blocks and show 
the interaction of the methods by means of a use case. The five methods addressed 
here are 


(i) uncertainty identification, 
(ii) uncertainty propagation, 
(iii) robust optimisation under uncertainty and/or multi-objective optimisation, 
(iv) sensitivity analysis, 
(v) model adaption. 


Firstly (i), for uncertainty identification we developed the concept of “data-induced 
conflicts”. Here, the trust in underlying data sources is identified, cf. Sect.4.2. Sec- 
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Fig. 3.6 Relation between (i) uncertainty identification, (ii) uncertainty propagation, (iii) optimisa- 
tion under uncertainty, (iv) sensitivity analysis of uncertain model parameters, (v) model adaption. 
Inputs are 0; and design variables x, outputs are 0o, which depend on the constraint functions g and 
objectives F1, F2, F3 


ondly (ii), uncertainty propagation helps us to quantify unconditioned uncertainty 
of system output data z, system functions g and system objectives F, cf. Sect. 4.3. 
Thirdly (iii), robust optimisation under uncertainty combined with multi-objective 
optimisation helps us to select the design variants x robustly, i.e. in such a way that 
the system quality F is optimised subject to the uncertain system function g. In other 
words, the system has an optimal quality F subject to the condition that it has to 
satisfy not only one, but a set of constraints in the uncertainty set ge U. Fourthly 
(iv), sensitivity analysis allows us to indicate those model parameters m which are 
most relevant for model adaption (v). 

The interaction of the five methods with a generic process and the data types 
introduced in Chap. 2 is best understood in a control loop or flow diagram with the 
generic input-output-process model, shown in Fig. 3.6 in its centre. At the boundary 
of the generic process, we recognise the data introduced in Chap. 2, i.e. 


(i) functional requirements g and quality data F = {F\, Fy, F3}, 
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(ii) input u split into design variables x and other input variables, 
(iii) output z, 

(iv) model parameters m, e.g. mass flux, energy flux, information, 
(v) internal variables y. 


The overall data of the generic process subject to uncertainty are collected into 
r = {0, g, F}. The model parameters m and design variants x are inherent to the 
model as depicted in the flow diagram. Perturbations to the model are not shown 
but recognised as present. Note that in terms of uncertainty propagation in process 
chains of Sect.3.2 the input would be 6; = 0 (minus the design variables) and the 
output 6, = z. Moreover, the assignment of data to a certain type is not strict. For 
example, it is common in optimisation to formulate a sub-objective as a constraint, 
cf. Sect. 5.1.1. Depending on the context and the method, a model parameter can also 
become an output datum, for example. 

To show the relations between the five methods (i)-(v) we will go clockwise 
through the control loop starting from the generic process. The reliability of under- 
lying data sources (i) is evaluated by means of the concept of data-induced conflicts 
presented in Sect. 4.2. 

The result of the generic process comprises the data z, given by the flows of mass, 
energy and information, further the system functions g and the system quality F. The 
density function p(r) is the result of uncertainty propagation (ii) through the process. 
The propagation of incertitude or stochastic uncertainty through general nonlinear 
processes are easily applicable for engineers and Monte Carlo experiments form 
a practicable method. The interpretation of the Monte Carlo experiments is based 
on the “law of large numbers”, see Chap. 2. That is, the signal to noise ratio of the 
experiment outcomes increases with the number of calculated samples. Hence, the 
downside of the brute force method in contrast to the moment methods can be the 
high computational effort. 

The result of the robust optimisation under uncertainty combined with multi- 
objective optimisation (iii) are suggestions how to select the design variants x. 
Depending on the subjectively selected weights between the three different sub- 
objectives, the components are selected, their size is determined provided the selec- 
tion is done from a size-ranged modular design and finally the operational conditions 
are determined. Hence, the optimal design and operational variants are determined 
by the robust optimisation under uncertainty and/or multi-objective optimisation. 

Sensitivity analysis (iv) is the fourth method in the control loop, cf. Fig. 3.6. In 
addition to the input data w and the design variants x, there are predefined model 
parameters m. In axiomatic models, these are often material parameters of consti- 
tutive equations, such as the modulus of elasticity in Hooke’s law. However, model 
parameters can also be dimensionless parameters as mentioned above. 

Iooss et al. [30] point out that “sensitivity analysis provides users of mathemat- 
ical and simulation models with tools to appreciate the dependency of the model 
output from the model input and to investigate how important each model input is in 
determining its output”. There are many methods for sensitivity analysis. Saltelli et 
al. [44] provide a concise review paper on this topic. Also Ghanem et al. [15] give 
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an overview on sensitivity analysis in Part IV of their “Handbook of Uncertainty 
Quantification”: there are local and global sensitivity methods. The local methods 
are gradient based, whereas most of the global sensitivity methods are probabilistic. 
For the method considered here, in contrast to uncertainty propagation, probabilistic 
sensitivity analysis is based on Bayes theorem, cf. Sect.4.1.2, i.e. on the concept 
of conditional probability. From the large number of local and global methods for 
sensitivity analysis we present only one. A very general, efficient and hence for engi- 
neers easily applicable global sensitivity method is the PAWN method used by Holl 
et al. [27]. 

From all model parameters m one is selected, i.e. m;. The sensitivity with respect 
to the selected parameter is given by Kolmogorov-Smirnov metric as originally 
proposed by Baucells and Borgonovo [3]. This is the largest distance 


KS(m;):= sup |P(l < L) — P(l < L|m = mi)| 
I 


between the unconditional cumulative probability function P(/ < L) and the large 
number of conditional cumulative probability functions P(! < L|m = m;). Here the 
model parameter m; € [min, max] is selected arbitrarily from its interval. We have 
L numerical experiments. The /th experiment is identified by the numerator /. 

The larger the sensitivity of m; the more attention is to be paid to this parameter. 
The model adaption (v) is gained manually or again by means of optimisation meth- 
ods. The model adjustment can have several stages: Firstly, model parameters can be 
adapted. Secondly, the model granularity can be adapted and thirdly, the model type 
or structure can be customised. The adaptation of model parameters mentioned here 
is mostly understood as calibration. The model granularity concerns the time and 
space resolution. The most profound change is the adaptation of the model struc- 
ture. Here, model structure should not be mismatched with structural uncertainty 
introduced in Sect. 2.3. 

In a data-driven model, the structure is given e.g. by the number of layers in an 
artificial neural network and the calibration determines the weights of each neuron’s 
input. Obviously the change of structure is more profound than the calibration of 
the weights, and obviously the calibration is based on optimisation. The counterpart 
of the data-driven model is the axiomatic model. The structure of such a model 
must be adjusted if the model is to describe wave propagation, however, the model is 
represented by an elliptic differential equation. The calibration of data-driven models 
is widely used today. More interesting is the structural adaptation of axiomatic or 
grey-box models. 

Four case studies are included in the chapter to illustrate the content. Depending 
on the reader’s interests, the case studies may be read or skipped. 

The first case study presented applies the concept of a multi-pole process chain, 
uncertainty propagation by MCS and sensitivity analysis. Furthermore, firstly the 
concept of parameter optimisation based on scalable modules is presented, and sec- 
ondly the transformation of a transient investment into a time-invariant cost flow is 
shown. 
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Fig. 3.7 Multi-pole representation of the energy ship; the structure is predefined; the size of the 
components, i.e. wind powered vessel, turbine, generator, desalinator, electrolyser, compressor and 
tank are design variants; the same is applicable to the operating parameters, such as the rotational 
speed of the turbine; to evaluate even ecological gains one information stream may equally be a 
flux of ecological costs Ec 


1st case study—Mastering uncertainty in the earliest design phase 


By way of illustration, we show how the named methods can be applied to control uncertainties in 
the earliest design phase of a regenerative system. The concept of an ‘energy ship’ is to be designed 
and evaluated under uncertainty. This ship is supposed to convert wind energy into electric energy 
using a wind-powered vessel. A hydrokinetic turbine integrated into the vessel is used to convert 
kinetic energy of the water into electricity. In a further step, the electricity is used to produce 
hydrogen using sea water. 

The obvious advantages of the ‘energy ship’ compared to far off-shore wind power are threefold: 
firstly, the energy supply system solves the transport problem of off-shore electricity production 
inherent in the system; secondly, availability is increased compared to existing solutions by allowing 
the ship to avoid a storm; thirdly, known modules, each with known uncertainty, are combined to 
form a new system. We will return to this point in Sect. 3.5 when speaking about flexibility enabled 
by combining modules. 

The process chain needed as a basis for a decision for or against a technology made under 
uncertainty is a techno-economic model of the ‘energy ship’ using the multi-pole representation 
introduced in Fig.3.7. The fluxes through the chain are the fluxes of energy, mass and money. 
The system model is formed by the process chain, the model uncertainty is given by the uncertain 
physical and economic parameters. 

To shed some light on model uncertainty, here, we will only focus on the economic model. 
The physical model parts may be found in [40]. The simple balance reads profit=revenue-costs: 
G = R — C. There was no periodic profit G, if the mass specific production cost of hydrogen would 
equal the market price fm,. Hence, the system design should be oriented at the threshold G=0. 
If the production costs equal the market price, the production costs are named levelised cost of 
hydrogen (LCOH), i.e. G = 0 : LCOH = fin. 

The main and first part of the costs are due to the investment costs Jo. The smaller second part 
of the costs are due to the maintenance; usually they are assumed to be proportional /o. The factor 
A is a rate, i.e. the dimension is an inverse time. Hence, the maintenance costs rate are Alp. 

Since Jp usually has to be spent immediately at the beginning of the project, investment is 
inherently a time variant process given by Dirac’s delta function, /oö(f). In order to make decisions 
under uncertainty, time-variant problems are much more difficult to treat than time-invariant prob- 
lems, cf. Fig.3.11. Fortunately, we can transform the transient investment Ioö(r) into an equivalent 
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time-invariant cost-flux Co = const using a method developed by Simon Stevin as early as 1582 
[50]: the time-variant process of increasing money volume for a fixed value or changing value of 
a fixed amount of money is captured by the interest rate minus the inflation rate, i.e. the effective 
interest rate z(t). The time-variant process of the information data “money” is given by the evolution 
equation 

dZ i 

= z(t)Z, withZ (0) = Ip. 
Here, we use the shorthand and much clearer notation of calculus instead of the usual summation 
notation. The evolution equation represents the development of money volume on the money market 
due to compound interest. Solving this simple initial value problem using the transformation to a 
dimensionless time T(t) = Ja z(t’) dt’ leads to Z(t) = Inge”). Now, Jo is not put on the money 
market at time t = 0 but invested causing a cost flux C at time t > 0. The compound interest of 
the time span [0, t] is covered by the factor e”. Hence, in determining the equivalent cost flux 
C we demand the equivalent d/ge7 = C dt. Integration over the time period [0, T] leads to 
Ih = H Ce~7 dr. For the special case of constant cost flux C= Co = const we can define the 
ratio of cost flux Co and invest Jo as the capital recovery factor. 


Co 1 1 1 


CRF:= = = T3 
Io A e Od T1l—e? 


In analogy to A, the dimension of CRF is a rate, i.e. 1/s. The right side of the above equation 
is gained for constant effective interest rate z = const. As a result, the cost flux is given by the 
investment costs Jọ multiplied by the sum of the capital recovery factor CRF and the maintenance 
rate à: C = Ig(CRF + A). Hence, by Stevin’s “trick” we transformed a time-variant process into a 
time-invariant process. 

On the other side, the revenue flux R = 5 Tmp, fm, gained by the sale of hydrogen, embodies 
the counterpart of the cost flux. Here, the capacity factor is denoted as ô. Hence, the dimensionless 
product ôT measures the availability of the system introduced in Chap. 1. 

From the balance G=R-C = ôT mn; fa, — Io (CRF + A) we derive the levelised cost of 
hydrogen (LCOH) to be 


Ig(CRF + 
esos LCoH = LOREEN 
Tmp, 


Here, mp, is the hydrogen mass flow. Speaking again in system’s function and quality: the function 
of the system being here in focus is to convert energy. The quality of the system is given by LCOH. 
This quality is increased, if the effort measured in investment cost Jp = Li I; is decreased, if 
the availability measured in ôT is increased or if the maintenance cost rate A/o is reduced. 

Hence, the design task is described by 


min LCOH s.t. g(x) < 0. 
xX 


The constrains g(x) are given by the mulit-pole model of the system. There are binary and real 
decision variants. A binary decision is needed in deciding whether the hydrogen production on 
the ship uses salty seawater or stored fresh water. In the first case a desalinator is required as an 
additional module, in the latter case not; but using fresh water would require an additional tank 
with a limited capacity. The real design variants determine on the one hand the size of the modules. 
These are usually obtained as size ranged modules. On the other hand they determine the operational 
variant such as rotational speed of the turbine. 

Here, as opposed to the example in Sect. 1.5 as well as further examples within this book, we 
ignore the binary decisions. Thus, in our example the structure of the system is predefined and 
sketched as the process chain in Fig. 3.7. The design variants are provided by the questions “what 
should be the length x; = L of the vessel?”; “what should be the size of the turbine measured in a 
cross-sectional area x2 = A?” etc. 
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Fig. 3.8 Empirically derived investment cost models /x « x for some of the modules needed to 
compose the energy ship; the 95% prediction interval J; + ex is given [27] 


The individual investment costs J; scale with the design variants by means of power laws 
Ik x xe as a market survey for size ranged components indeed shows, cf. Fig. 3.8. 

Together with the physical model based on the energy, continuity and momentum equation, the 
techno-economical model is defined. The techno-economic-ecologic system model is a multi-pole 
model as described in the previous section. The model maps the input data 6; = 9 to the output 
data 6) = 0g by the matrix multiplication 6; = A@): A = më Ax. The entries of the 4 x 4 system 
matrix are the technical, economic and ecologic models being described by Holl et al. [27]. 

Figure 3.9 shows that the techno-economically optimal system analysis is defined by a vessel 
length of 37m with the help of stochastic optimisation. At the optimum, the turbine area is 0.9% 
of the sail area. For this and all the other design variants not shown here, the levelised costs of 
hydrogen are 13.9€/kg. Comparing this quality datum with the 2-3 €/kg for methane reformation 
shows that the production costs, even for the optimal system, are still high. 

So far we have only addressed the prediction uncertainty of the component models, cf. Fig. 3.7. 
A global sensitivity analysis allows us to identify those model parameters m; € m on which the 
optimisation result shows the largest sensitivity. In return, when adapting the model one should 
concentrate on mastering the uncertainty in the most sensitive model parameter. 

Figure 3.10 shows the mean of KS(m;) [3] for some model parameter. The result is most sensitive 
with respect to uncertainty in the sail’s lift parameter c;. The system shows only a small sensitivity to 
the vessel displacement parameter relating the displacement volume to the cube of the ship’s length, 
€ =p. Interestingly, the system shows only an intermediate sensitivity to the availability ôT. 


Insummary, this section reveals that the process chain model is at the heart of methods 
for mastering uncertainty. The methods discussed are complimentary and differ, for 
example, in terms of conditional and unconditional probability. Finally, we have used 
an example to show how a system can be evaluated in an early design phase. Here, 
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Fig. 3.9 Arithmetic average LCOH + e (e represents 95%-confidence interval) for all combinations 
of dimensionless turbine area and vessel length; the sweet point is shown to be a triangle [27] 
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Fig. 3.10 Sensitivity analysis of the techno-economic optimal system (left) and graphical clarifi- 
cation on the example of the most sensitive and the less sensitive parameter [27] 


it is necessary to map a time-variant process into a time-invariant process. Whether 
and how such a transformation succeeds is always problem- and model-specific. In 
the following section we will see how degradation can be treated in time-invariant 
terms, section by section. This leads us to the next section where we classify the time 
characteristics of process chains. 
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3.4 Time-Variant, Dynamic and Active Processes 
Peter F. Pelz 


Mechanical engineers are trained to solve problems in the field of dynamics, but 
they are much less familiar with the task of creating an optimal design of transient 
processes under uncertainty. Experience has shown that making decisions under 
uncertainty is much more difficult for time-variant processes than for time-invariant 
processes. Therefore, in the following criteria are to be compiled to determine when 
an actually time-variant process can be treated as a time-invariant process. Before 
doing this, itis worthwhile to classify the time-variant characteristics of the processes. 

Figure 3.11 shows the Euler diagram that classifies the time characteristics of 
processes. Synonymous for time-invariant is stationary, synonymous for time-variant 
is transient. 

A process is quasi-stationary if it reacts immediately to a temporal change in the 
boundary condition. In dynamics, a process is quasi-static and at the same time quasi- 
stationary when the system is excited by a frequency f far below the system’s lowest 
natural frequency: f & 1//LC. Here L is the inductance representing a solid or 
liquid body or an electric coil and C is the capacity or compliance associated with 
the storage of energy in a spring, in a gas volume or within an electric accumulator. 

There is a slightly different case when the external load is in balance with frictional, 
i.e. dissipative œ R, and elastic, i.e. conservative x C~', forces. The system then 
shows a relaxation time which is given by the product RC. The relaxation time 
is the typical time a system needs for relaxing to an equilibrium when disturbed. 
For f < (RC)! the system behaves quasi-stationary. The model granularity with 
respect to temporal resolution is determined by the functional quality of the process 
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Fig. 3.11 Euler diagram for classification of time-variant and time-invariant processes 
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Fig. 3.12 Design of a hydrostatic transmission aiming for (a) the minimal number of valves; 
(b) minimal particle erosion over the life time of the hydrostatic transmission [53] 


which shall be resolved in time. Thus the highest natural frequency being resolved 
is determined by the quality promise given explicitly or implicitly to the customer. 

Special types of time-variant processes, i.e. transient processes, are periodic, 
1.e. cyclic processes. Again, a special type of cyclic processes are harmonic pro- 
cesses. Figure 3.11 indicates that the process complexity in terms of time behaviour 
is reduced if a time-variant process can be mapped to a time-invariant process or if 
a transient process can be mapped to a harmonic process. An example of the former 
was given in the first case study, in which the time-variant investment was mapped 
to the equivalent time-invariant cost flux, for the latter transforming the linearity of 
the process is usually required as a prerequisite. 

The second case study presented now is a degradation process, i.e. a time-variant 
relaxation process. The lesson learned from this will be how degradation can be 
treated for system design under uncertainty. 


2nd case study— Modelling of degradation 


Figure 3.12 shows two different optimal hydraulic structures (a) and (b) a hydrostatic transmission 
that performs the very same function. The function is given by a load profile. This is cyclic with 
phases of constant and possible uncertain load and speed. For an assumed ideal rigid system, i.e. 
vanishing compliance C — 0, the system behaves quasi-stationary with respect to power transmis- 
sion. For the algorithmic system design it is allowed to select 2/2-way and 4/3-way proportional 
and non-proportional valves. 

For structure (a), the design objective has been to minimise the number of valves needed to 
establish the hydrostatic transmission. For structure (b), the design objective has been to minimise 
the particle wear of the valves in each load cycle over the life time of the hydrostatic transmission. 
Mastering the structural uncertainty, cf. Sect. 2.3 in case (a) is simple: the design solution with two 
proportional and two non-proportional valves is obvious. The control of the structural uncertainty 
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in case (b), on the other hand, is far from obvious. Although the system is dynamically time- 
invariant, due to the degradation process the system is time-variant in a long time frame. To master 
the structural uncertainty in the design process a degradation model has to be envisaged in the 
constrained optimisation. 

In this case study, the degradation is depicted very generally as a relaxation process. This 
approach can be applied to many other ageing and wearing processes: particle erosion is one 
possible reason for degradation. Others are chemical degradation or hardening of polymer material 
due to temperature activated diffusion and/or chemical reaction. Also damage accumulation in 
cyclic loading of components may be treated as a degradation process. 

For each of the mentioned processes, the degradation of a component property F may be 
described by an evolution equation ar = f(t, L(t), F). Here, t is the time and L(t) the load 
history of the component. The initial condition is F(t = 0) = 1 for the degradation process and 
F (0) = 0 for the complementary accumulation process. A separation approach of the right hand 
side is a good model of most degeneration or accumulation processes seen in nature and technology. 


a = K(L(t)) f(F). (3.1) 
Here, the load history L(t) and the time r enter the equation only implicitly by means of the 
degradation rate K = K(L). The dependency is implicit, since only the rate depends on the load 
history. In fact we came across the evolution equation in the previous Sect.3.3 where the rate 
is represented by the interest rate z(t). The interest rate is determined by the global market and 
the central bank. The degradation rate is determined by the process intensity, i.e. the load. If we 
know K (L) and the load history L(t) we know the erosion process. The load history L(t) is either 
determined by the measurement in the usage phase or by providing a model for the expected load 
history L(t) based on our past experiences gained in the same or a similar process. 

Transformation to a dimensionless time d9 := K dr, (0) = 0, yields a = f(F). Thus, with 
an increasing load the rate K increases and the physical time t moves faster. Here, F:=M/ Misa 
product property M in relation to its initial value M inthe case of a degeneration or to the saturation 
value M in the case of an accumulation influencing the product’s function. 

In technical systems often the initial degradation or accumulation phase is more relevant than 
the later phase. With a view to the asymptotic limit in the initial phase, the initial phase on the 
right-hand side of the evolution equation is independent of F. Hence, an approximation for the 
initial degradation or initial accumulation process is given by a ~ +1. This leads to the damage 
accumulation. 


MU = 40) = K [LE] ae’, (3.2) 
M 0 


known as Palmgren—Miner’s rule [33, 37]. 

Figure 3.12b shows the optimal hydraulic structure with regard to the minimal particle erosion 
over the lifetime of the hydrostatic transmission. For particle erosion, the erosion rate is a function 
of the volume fraction c, of solid particles within the fluid, the pressure drop history Ap(t) across 
the valve, the history of the relative valve opening 0 < z4 (t) := 20 < 1, the maximal cross sec- 
tional area 7Dzmax being proportional to the diameter D of the spool valve and the oil density 
o, cf. Fig.3.13. For dimension reasons we have the equivalent representation of the degradation 
rate K (cy, z+, Ap, 0, 7 Dzmax) = K4 (cv, z+ (t))/Ap@/(a Dzmax 0). For a load profile such as 
the one sketched in Fig. 1.7b the degradation process may be treated as stationary in each load 
phase of the load cycle. 

The valve’s function is given by the pressure amplification factor V:= a Hence, the functional 
degradation Az in each stationary phase of duration Ar is given by - 


A A K ApAt? 
Ss Sh Seg ee Me 1. (3.3) 
Z Z+ 3 7 Dzmax 0 
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Fig. 3.13 Erosion model of the particle wear of a spool valve a. The experimental data b are 
generalised by means of a dimensional analysis [53] 


With a view to finding an optimal structure in terms of minimal wear depicted in Fig. 3.12b a mixed 
integer nonlinear program (MINLP) is to be solved by 


min max ) Az s.t. g(x) <0. (3.4) 
xX valves 
load phases 


In the MINLP the hydrostatic transmission is represented by a complete graph. Each possible 
valve, Fig. 1.7a, is mapped to an edge of the graph. The nodes are the hydraulic connections. The 
constraints g(x) are given on the one side by the continuity and energy equations for each edge or 
node. On the other side they are given by the load profile sketched schematically in Fig. 1.7b. 


As lessons learned, firstly, mastering structural uncertainty requires here the solu- 
tion of a MINLP. Secondly, model uncertainty is relevant for the degradation model 
depicted in this case study. Thirdly and finally, the load profile sketched in Fig. 1.7b 
may be uncertain itself. Taking into account this uncertainty requires robust optimi- 
sation, cf. Chap. 6 techniques as presented in this book. 
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Costs and gains of active components 


If one thinks of technologies to master uncertainty, one can think of active or “smart” 
technologies. Active technologies promise new degrees of freedom and the ability to 
adapt to unforeseen circumstances. Despite this promise, it is surprising to find that 
in practical applications far fewer active solutions are implemented than engineering 
research would suggest. 

On the one hand, a reason for this is that the total costs for integrating active com- 
ponents can be considerable. On the other hand,—contrary to the actual intention— 
active components can also make a system vulnerable, because active components 
do not only include an actuator but also sensors, controllers as embedded software 
modules, software interfaces, cables, and connectors, all of which may fail. As seen 
in Chap. 1, training, legal conformity certification, commissioning, release, version- 
ing, maintenance, procurement and much more increase the number of topics that 
influence the uncertainty of the system from a holistic point of view. If these are not 
mastered, the system may possibly be damaged. 

It is therefore a conflict of objectives that has to be resolved. What are the costs 
and gains of the active components? Figure 1.11 helps with orientation: it is a matter 
of clearly formulating and weighing the function and the objectives and then decid- 
ing whether to use active components or not. What is also helpful is to answer the 
question: “What does an active component promise in an ideal case?”. The answer 
to this question is an answer such as “as good as it gets” with respect to effort, avail- 
ability, acceptability. The answer to the question “What does an active component 
promise in an ideal case?” usually leads to a Pareto boundary, Sect. 1.6. 

Also here, mastering uncertainty is made easier if individual processes are defined. 
Hence, it is worthwhile to classify types of active processes. In the generic process 
chain shown in Fig.3.1 we distinguish between active and semi-active processes. 
The classification is as follows [6]: 


(i) for an active process, energy is transferred to the process and finally to the 
product or system directly; 
(ii) by asemi-active process only the work equipment is adapted by the input energy; 
(iii) a passive component or process is neither active nor semi-active. 


A passive process may be a storage or a transport process. A passive component 
is e.g. a coil spring. An illustrating example of a semi-active process is the semi- 
active damper shown in Fig. 1.2. Manually, the damper setting may be changed from 
“hard” to “soft” by rotating the actuating lever. In the usage phase, no external energy 
is supplied for controlling the two connected sub-systems. This is different for the 
Active Air Spring being presented in Sect.3.6.2 where the external energy is used 
to isolate two dynamic systems from each other. Thus, even the system’s resonance 
when excited at the natural frequency may be suppressed by the active system. 
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Fig. 3.14 Improvement of functional quality through an active component, here the Active Air 
Spring: A compact vehicle drives over a country road at a constant speed of 70 km/h. The standard 
deviation of the body acceleration is plotted against the time-averaged actuating power. The hori- 
zontal asymptote is determined analytically under the assumption of unlimited actuating power and 
actuating speed [43] 


Example—Suspension system with integrated Active Air Spring 


Figure 3.14 illustrates the improvement of the functional quality when replacing 
a passive component by an active one. Here, the benefit is an improved isolation 
function of a vehicle body from a country road’s bumps. The picture results from 
a hardware-in-the-loop ride of a compact vehicle with a speed of 70km/h along 
the road, cf. Fig.3.14. The active component is the real hardware whereas the road 
and vehicle are virtual. For the passive system the standard deviation of the chassis 
acceleration is 0.81 m/s”. The asymptote is given for the ideal active system by 
0.58 m/s”. This asymptote is formally derived by assuming an actuator with unlimited 
available actuating power and unlimited actuating speed. Figure 3.14 shows that, with 
the Active Air Spring, this level is sufficiently approached with a power consumption 
of roughly 10 W to 15 W for a compact vehicle such as the VW Golf. For reasons 
of dimension this power increases linearly with mass. The power consumption for a 
luxury vehicle having twice the body mass is 30 W for one vehicle corner and hence 
120 W on average for the vehicle. 

With regard to Figs.3.5 and 3.14, the acceptability of the system arises by an 
increased quality of the functional performance. On the other hand, the energy and 
cost efforts are increased by the active components. Moreover, the additional com- 
ponents reduce availability due to their vulnerability as discussed above. 
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Fig. 3.15 Reduced effort measured in relative reduction of material consumption. a Robust opti- 
mised truss structure allowing only passive modules; b robust optimised truss structure allowing 
active components; ¢ material saving with increasing number N of active modules and increasing 
actuator performance, cf. Sect. 6.1.2 


Example—Truss structure with integrated actuator 


In the above example, the active components serve to increase the functional quality 
of the system. From a different point of view, we may think of having the func- 
tionality unchanged and the active components serve to reduce the effort in material 
consumption. 

This is exemplified by comparing two truss structures shown in Fig.3.15a, b: 
Fig.3.15a shows the optimised topology resulting from a robust optimisation of 
a passive, static system; Fig.3.15b shows the structural optimisation for the same 
function, namely bearing defined load scenarios, when additional active components 
marked by a red box are integrated. Figure 3.15c shows the volume saving relative to 
the optimal passive system by replacing N = 1, 2, 3, 4 passive bars with active bars. 
The actuator performance is measured in the dimensionless actuating force ranging 
from 0 to 4. 
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3.5 Strategies for Mastering Uncertainty—Robustness, 
Flexibility, Resilience 


Peter F. Pelz and Marc E. Pfetsch 


In this section, we present three outstanding strategies or concepts for mastering 
uncertainty. These serve as a guide taking us on a tour throughout the book, i.e. we 
will introduce methods and technologies, cf. Chap.5 that help us to implement the 
strategies. Chapter 6 is devoted exclusively to the three strategies. 

The three strategies or concepts we identified to be most important in mastering 
uncertainty, cf. Chap. 6 are to 


(i) design and operate robustly, 

(ii) gain flexibility, 
(iii) enable resilience. 
The so far cited demand for closing feedback loops may be seen as underlying to 
most aspects of the three strategies. This section serves to predefine, structure and 
exemplify the three strategies. 


What distinguishes a robust system from a flexible and from a resilient one? 


The need of the user is represented by the function g of the system. The function 
is always described by a verb such as ‘carry’ whereas the quality is given by the 
adverb, e.g. ‘carry safely’. I.e. the adverb represents the quality F = {F\, Fo, F3} 
of how this function is fulfilled. We distinguish between a general quality and a 
functional quality. The general quality is to be understood as a generic term for 
minimum effort F;, maximum availability F) and maximum acceptability F3. These 
three sub-objectives result in the multi-criteria objective function. As explained in 
Chap. 1, acceptability can be achieved by the degree of function fulfilment, i.e. dg. 
This is the functional quality that is commonly understood as the quality of a product 
or system. 

By concentrating on the function of the system and the effort required to achieve 
this function, we can now easily distinguish between robustness, flexibility and 
resilience. The differences are concisely collected in Fig. 3.16. 


(a) A robust system is characterised by the fact that the system fulfils one predefined 
function g with accepted functional quality 6g, even if the function and resources 
have been described uncertainly or are uncertain themselves—as long as they are 
part of the specified uncertainty set—or even if the system is disturbed by uncer- 
tain external influences. For the constrained optimisation problem the objective 
function is given by min {F}, — F2, — F3} where the effort is given by F;. 


(b) A flexible system is characterised by the fact that the system fulfils i = 1,..., N 
predefined functions g; with accepted functional quality ög;. For the constrained 
optimisation problem the objective function is given by min{ X; Fy ;, —Xj Fi, 


— X; Fz i}. Usually the effort F; is the most important task; i.e. several functions 
should be possible with minimal effort: min X; F; ;. 
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Fig. 3.16 Distinguishing robust, flexible and resilient systems from the perspective of the system’s 
functions: a a robust system does not only fulfil its function at the design point, but also in the 
surrounding neighbourhood, the so-called uncertainty set; b a flexible system does not only fulfil 
one function but several functions i.e. several design points; ¢ a resilient system fulfils its function 
at the design point like a robust system but still enables a residual function when disturbed; the 
system has the inherent ability to recover 


(c) A resilient system is characterised firstly by the fact that it does not only fulfil a 
predefined function g such as a robust system, but also retains a residual function 
res, if the system is disturbed at time t = 0. A resilient system may secondly 
show the ability to recover: from a distorted state, the system may recover in a 
time t = 0,..., T toa function g(x) > g'(x’) and/or a quality F(x) > F’(x’). 
This function and quality may not be foreseen in the previous design and pro- 
duction phases. The design variants undergo transformation from x to x’ during 
the evolution. 


Robustness 


Above we have defined the characteristics of a robust system. Here we would like to 
discuss how to establish a robust system. The comprehensive strategy is a methodol- 
ogy with many facets called robust design. Robust optimisation is a method needed 
in this methodology as we will demonstrate in a short example within this section 
and indeed in many examples throughout this book. 

Robust Design goes back to Genichi Taguchi [14, 41]. In 1949, he started to 
develop the methodology of offline quality engineering, as Taguchi called it. The 
development of the method was accompanied by a project aimed at modernising the 
Japanese telecommunication system. The methodology proceeds from the system 
level to the product and process parameters. To reduce the influence of uncertain 
product and process parameters on the performance or functional parameters of 
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Fig. 3.17 Robust parameter design of a hydro-pneumatic suspension strut treated as a constrained 
optimisation problem; a shows the component and b the system; given is the list of functional param- 
eters, input/output data, decision parameters and model parameters; note the change in parameters 
by broadening the view from the component to the system 


the system, the sensitivity of design and process parameters are first determined 
by Design of Experiments (DoE). Following this first step called system design, 
the design variants are selected by robust optimisation. This second step is called 
parameter design. In the last step, called tolerance design, the tolerances for the 
design and operating parameters are defined. 

Robust control in control theory is an approach to controller design. Hence, it 
has only one component of the system, the controller in focus. This controller shall 
provide its function for an incertitude range of system parameters. Thus a robust 
controller is static in contrast to an adaptive controller, adapting itself to system’s 
variations [1]. 

In conclusion, the robustness of a system is gained by a methodology. Per se it 
does not need any special effort measured in investment or material. Of course, it 
is important for engineers today to know and apply the methods of Robust Design. 
They are constantly being further developed. Thus, the robust optimisation described 
in this book lays the foundation for Robust Design. 


3rd case study—Parameter engineering in the methodology of Robust Design 


The following case study firstly illustrates the parameter design as understood by Taguchi. Secondly, 
the case study further illustrates the benefits of inherently robust design and operational concepts 
when discussing the various physical effects that can be used in a suspension system. 

Figure 3.17 shows the hydraulic scheme of a hydro-pneumatic suspension strut known from 
mobile hydraulics, forming presses or from the chassis of the Citroen DS passenger car. The function 
of the system is given by three sub-functions g = {gi, Zii, giii}: 
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(i) The first sub-function supports a chassis of mass m with the mass specific gravitational constant 
go resulting in the time averaged force Fo = mogo at a distance / above the ground. 
(ii) The second sub-function, the levelling known from the Citroen DS, is to enable a constant 
distance / independent of the loading Fo = mogo. 
(ii) The third sub-function is to isolate the chassis from vibrational excitation by the bumpy road. 


This third sub-function is ensured by having a compliant system with the capability to store energy. 
Thus, the system has a natural frequency as discussed in Sect.3.4. For an excitation frequency 
Q?/2 > w= the system is in isolation. Hence, the natural frequency w, is a predefined, i.e. 
specified value characterising the function of the system. 

In Chap. 1 we discussed the objectives to be met when designing systems, cf. Fig. 1.9. All the 
three part-objectives, effort Fı, availability F2 and acceptability F3 form the general quality of 
the system. The acceptability is fostered when the special quality of the system, i.e. the degree of 
the functional fulfilment is improved. Every physical-technical system that fulfils the functional 
description given above competes in quality. The latter is given by the variance, i.e. the stochastic 
uncertainty (dw)? of the square of the system’s natural frequency. The better the desired natural 
frequency is hit by a technical system the better is the system’s functional quality. 

Ina mass production we anticipate the uncertainty of the functional parameters, here the square of 
the natural frequency w? as w? = W? + (dw)*. While the discrete variants are assumed to be already 
selected when defining the structure, the task of the parameter design introduced by Taguchi is to 
select the continuous design variants u in such a way that the constrained optimisation problem is 
solved: 


min (dw)? su = we. (3.5) 


Here, ws is specified and thus fixed, whereas W and dw both depend on the design variants u. The 
task function is clear: we would like to have a minimal uncertainty in the functional parameter, 
i.e. the eigenfrequency. In the competition of physical modules we compare three systems, coil 
spring, hydro-pneumatic suspension and air spring. A coil spring alone would allow the first and 
the last sub-functions but not the levelling function. Hence, the coil spring fails the competition. An 
air spring allows all the three sub-functions; and air springs are indeed standard for load-bearing 
systems when there is a large variance in the mass mo € [mmin, Mmax] as it is given in commercial 
or rail vehicles. But air springs require a compressed air system including compressor, air dryer 
and filter to level the system. This results in a constant time averaged gas volume Vo in a loaded 
condition independent of the loading Fo and hence mass mo. 

The needed effort, i.e. the investment in hydro-pneumatic systems is usually smaller. Here, 
the sum of gas and oil volume is constant within the suspension strut sketched in Fig. 3.17. With 
increased load Fo oil is pumped by means of a pump into the system of constant volume. Hence, 
the gas within the hydraulic accumulator is compressed. The gas mass m, does not change by the 
levelling. 

For a minimal effort, we therefore would select in the first place a hydro-pneumatic suspension 
system. The design variants to be selected for the system are the absolute gas pressure po of the 
accumulator and the gas volume Vo of the accumulator in the unloaded condition, u = (po, Vo). 
In our nomenclature po is an operational variant for the manufacturing when the system is initially 
filled and Vo is a design parameter. Both decision variants are uncertain. Presuming we know the 
incertitude in both decision variants, i.e. the operational variant of the production phase po = Po + 
6 po and the design variant Vo = Vo + 5Vo we may solve the constrained optimisation problem. 

Ignoring uncertainty of the use phase assumes a fixed suspended mass mo = const. The stiffness 
k of the suspension is the derivative of the force F compression z relation, i.e. 


dF Fe 
=Yy : 
dz | pon PoVo 


k := (3.6) 


Here y is the isentropic exponent of the gas, i.e. a model parameter, cf. Fig. 3.17. With k? = k? + (5k)? 
and the specified stiffness ks = w?mo the constrained optimisation problem can be written as in an 
equivalent unconstrained problem by introducing the Lagrange parameter A 
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min [ (oe? “26 = ks) | (3.7) 


Po, Vo, À 


(the two terms inside the square brackets sum up to the Lagrangian function). This problem is solved 
using Gaussian error propagation introduced in Sect. 3.2 for uncorrelated uncertainty 


Ok \? Ok \? 
(5k)* = (5) (Spo) + (=) ($Vo)”. (3.8) 
öpo (Vo, po) OVo (Vo, Po) 


Hence, the parameter design, as Taguchi named it, yields the optimal value for the design variants: 


(7). = (Grn = VERO (3.9) 


For this set of design variants, the product is said to be robust in the sense that the disturbances, i.e. 
the uncertainty in realising the pressure and volume, has the minimal impact on the uncertainty of 
the demanded functional property, i.e. the uncertainty of the stiffness. 

So far Robust Design was applied and used on a component level; and as Fig. 3.17a indicates, it 
is the component for which the functional quality is indeed the stiffness. However, the quality the 
customer is interested in is not the quality of the component but the quality of the system. For the 
suspension system the functional quality is the natural frequency, Fig. 3.17b, and not the component’s 
stiffness. Thus the sketched example is a typical example of how the system boundary, and hence 
the system view, cf. Fig.3.3a, influence the design objective. For the—already disqualified—coil 
spring we have w « 1/,/mo. If we demand (w)? to be small as a quality measure, storing energy 
by an elastic torsion of a beam—as it is done by storing energy in a coil spring—is not a physical 
effect ensuring robustness. The hydro-pneumatic suspension discussed above gives w x Ymo, i.e. 
the natural frequency increases with increasing load. This results directly from the given stiffness. 
Hence, both physical effects do now allow robustness with respect to mastering uncertainty in 
mo € [Mmin, ™max]- 

There is a third principle to fulfil the three sub-functions. An air spring allows w = const due to 
separating the sub-functions into (I) carrying and (III) isolating. In other words the air suspended 
system inherently uses three effects of functional separation. The load carrying sub-function is 
gained by the force balance Fo = (po — Pa)A = mogo with the ambient pressure pa and the springs 
cross-sectional area A. The levelling is done by adapting the pressure po to the loading. The air 
spring’s stiffness is 


dF A? 
k= = Ym—. (3.10) 


dz |p- Fo Vo 


Hence, the natural frequency of an air spring with po > pa is 


Pa ee. (3.11) 


It is independent of the uncertain model parameter mo € [Mmin, Mmax ] and the system is robust 
with respect to uncertainty in the usage phase at least in this one aspect. Typically, the height of a 
cylindrical spring ap * 350 mm. This results in a natural frequency of 1 Hz. Indeed, if we compare 
springs in different applications, such as chassis of trains, commercial vehicles or passenger cars, 
they all show the same height of roughly 350mm. The height is adapted to the sensitivity of adult 
humans regarding vibrations. The design is inherently robust with respect to the uncertainty in the 
usage phase. 
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Employing inherent robust design and operating concepts 


We have learned from the above example that sometimes uncertainty can be over- 
come by choosing an inherently robust design and/or an inherently robust operating 
concept. In this example, energy storage in a gas volume is chosen as the physical 
effect. In the selected operating concept, the time-averaged gas volume (not the gas 
mass) is constant. This means that all three sub-functions mentioned above can be 
fulfilled independently of each other: carrying, levelling and isolating. In summary, 
the separation of functions was chosen as a concept to achieve robustness. 

Separation of function is not the only concept inherently leading to robustness. 
Here we give a short, certainly incomplete list of design principles that are familiar to 
many engineers. Each concept fosters robustness and is hence a way how to master 
uncertainty. The seven design principles that inherently lead to robust construction 
solutions are to: 


(i) enable overload protection, 
(ii) enable overload capacity, 
(iii) enable self-adaptation to increasing loads, 
(iv) enable compensation of uncertainty, 
(v) enable self-healing, 
(vi) separate functions and 
(vii) close feedback loops. 


Each design concept and each concept of operation are illustrated by some short 
examples: 

First (1), the overload protection is provided, for example, by a pressure relief valve 
or a split pin with a defined shear force. Cellular solids or foams [2] show an overload 
protection provided by the material itself. As long as the foam still has a compression 
margin, the compression force is basically determined by the buckling load of the 
cell walls. The foamed elastomer sole of jogging shoes enables—as desired—high 
energy absorption with a small force amplitude. The same principle, high energy 
adsorption with small force amplitude in the force-displacement diagram, is used for 
crash structures and railway buffers. 

Second (ii), the overload capacity is made possible by additional energy storage. 
As to plastic materials, the energy storage is the irreversible deformation work with 
overload. As is well known, brittle materials tend to fail spontaneously. This principle 
applies in general. Supply and energy chains become robust if storage devices are 
integrated. 

Third (iii), the self-adaptation to increasing loads is made possible e.g. by an 
O-ring: the higher the fluid pressure the higher the sealing contact pressure between 
the elastomer and the solid surface. The elasticity is a prerequisite for this elegant 
way of mastering uncertainty in the usage phase. This prerequisite was lost in the 
Challenger space shuttle disaster [52], because the elastomer of an O-ring tank seal 
had been frozen during a cold night. In the glass state, the material is frozen in a 
deformation state without the necessary contact stress. The leakage of fuel caused 
the explosion. The Challenger disaster is one more example of model uncertainty 
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ignoring either the influence of the temperature on the function of the seal or ignoring 
the temperature as a model parameter. 

The design concepts of overload protection, overload capacity and self-adaptation, 
especially as self-enhancement and self-repairing principles, are also used as a basis 
for the realisation of resilient system properties, cf. Sect. 6.3.2. 

Forth (iv), the compensation of uncertainty is reached by integrating elastic ele- 
ments at the interfaces of system components. Foil air bearings are typical for this. 
The integration of the bumpy elastic foil compensates uncertainty in the shaft and 
the journal diameter. 

Fifth (v), self-healing materials or structures are the dream of mechanical engi- 
neers. Unfortunately these are very rare. A current example is a modern mountain 
bike tire. The air tube is replaced by a liquid sealant which is added to the inside of 
the tire. Every small puncture is self-healed by this sealant. 

Sixth (vi), the separation of functions is the most basic concept to master uncer- 
tainty. A clear assignment of functions to components includes, for example, the 
avoidance of double fitting. The two functions sealing and load-bearing are known 
to be separate. A piston seal should not have a load-bearing function and a guide 
ring should not have a sealing function. In the above mentioned examples it is inter- 
esting to note that the separation of functions is a general concept to gain robustness 
of a system not only in the design and operation of technical systems: all modern 
forms of government use the principle of separation of powers [9]. Modern business 
organisations also identify roles, i.e. functions to gain robustness in many aspects 
including legal ones. 

When designing load-bearing systems, the concept of separation of functions is 
applied to the flow of forces and is referred to as the design for clarity, cf. Sect. 6.1.6. 
The clarity of force flow significantly supports the mastering of accumulated uncer- 
tainty from the product life cycle processes. 

Seventh (vii) closing the feedback loops is always a good advice: not always all 
facets of mastering uncertainty have to be considered: in nature, feedback control 
is a very successful concept to manage uncertainty; in Chap. 1 we pointed out the 
benefit to close feedback loops over the phases of the product life cycle. For feedback 
control, the model uncertainty discussed in Sect. 4.3 is only of minor importance. In 
fact, feedback control works even if there is no model of the system. On the other 
side, data uncertainty, i.e. the uncertainty of the measured or calculated data to be 
fed back, is most important when closing control loops. The situation is somewhat 
inverse in forward control. Here, in fact the model uncertainty and model quality are 
most important. 

The given list of inherent robust design and robust operating concepts is not 
complete. The presented concepts are subliminally present in every design task. It is 
inherent to the optimisation and learning, not only in mechanical engineering. 


Illustrating examples are e.g. the frequent weekly cooking of spaghetti and the rare roasting of a 
piece of meat. The latter may happen only for Christmas once a year. Only if the signal-to-noise-ratio 
when tasting salt is high enough, feedback will improve the cooking result of spaghetti from time 
to time. A typical feedforward control exists when the roast time of the roast has to be estimated 
in advance. This requires a model of the oven, temperature control and a model of the roast. The 
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model of the roasting is parameterised by the weight of the meat piece. A good cook has such a 
model in mind. Again the model does not need to be in a mathematical form even though it might 
be so. If the model uncertainty is too large, the result will be of poor quality. The open control loop 
can be closed by a roasting thermometer, so that uncertainty is controlled without using a model 
at all. 


Robustness, just like the mastering of uncertain loads, also requires insensitivity to 
disturbance parameters that affect the system externally. Knowledge of the influences 
on the system from its environment and vice versa is an essential prerequisite for 
development. The detailed analysis of disturbance influences by means of a process 
model is described in Sect. 5.2.3. In Sect. 5.1.2 it is shown how the documentation of 
desired functional properties and expected disturbance parameters positively influ- 
ences the development process. The choice of physical effects that are insensitive 
to the expected disturbances can fundamentally contribute to the robustness in the 
early phases of the system design as shown in Sect. 6.1.5. 


Flexibility 


A flexible system is characterised by the fact that the system fulfils i = 1,..., N predefined 
functions g; with accepted functional qualityé gj. 


Recapturing the above given characterisation, the question arises how this flexibility 
can be achieved. There are several ways how to gain flexibility and there are many 
perspectives on the topic, cf. the review article about gaining flexibility in manufac- 
turing [46]. As before, our perspective is a more general one being suitable to all 
phases of the product life cycle and also, as before, we have the systematic engi- 
neering design perspective [36]. From the functional view, we either can separate 
functions in different physical or software modules, or we can integrate functions in 
one physical module which may contain software modules. 


Smart modularisation or smart modules, both concepts may enable flexibility 


In the above explanations, we present the separation of functions as an inherent 
robust design and/or inherent robust operating concept. This applies at the level 
of a functional unit or a single component. Recognising that a module integrates 
some functional units, we have the opportunity to discuss the degree of functional 
integration in the module. Today the term “smart” module is ubiquitous. Therefore 
we should discuss the degree of “smartness”. This degree is determined by the degree 
of integration or separation of functions. 

In the following, we first differentiate between the two concepts to gain flexibility 
(i) modularisation by the smart separation of functions and (ii) smart modules by 
integration of function, see Fig. 3.18. This is followed by a more detailed look at the 
two contrasting concepts on how to gain flexibility. 

Figure 3.18a shows flexibility gained by separation of functions into m sub- 
functions and the associated m physical or software modules. The matrix gives the 
utilisation n ; of the different modules. The effort F; is minimal if the total utilisation 
jn; is maximised and at the same time the number of modules m is minimised: 
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Fig. 3.18 a Flexibility gained by smart separation of functions into m sub-functions and the associ- 
ated m physical or software modules; b flexibility gained by integration of function of the g1, g2,... 
user-defined individual functions into on master function realised by one smart module 


max % jn; A min m subject to that in practise physical modules count more than soft- 
ware modules. The number of modules m is a measure of the internal complexity 
with regard to the design and the production phase. The external complexity comes 
from the user’s view, e.g. the user would like to have common parts for maintenance. 
At the same time the specific user would like to have his or her needs matched fully 
by the system. Hence, the user experience should be kept in mind when designing a 
modular product. 

Figure 3.18b shows how flexibility is gained by integration of function of N user 
defined individual functions into one master function realised by one “smart” module. 
For the average user the system shows too much functionality, which is of course 
not bad for the user but may be costly for the producer. The part of the functionality 
used by one user is denoted by A; < 1. The objective for the integration of function 
is hence max Ù; A;. 

So far it has become clear that the two asymptotes of flexibility are first (i), 
“smart” modularisation and second (ii), “smart” modules. The first asymptote is a 
methodology, the second one is a technology, cf. Chap. 5. 
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Smart modularisation 


We discuss modularisation as a smart separation and integration of functions into 
standardised modules as a strategy of flexibility and hence of mastering uncertainty. 
A module is a physical unit with several integrated functional units. The module 
can be used to fulfil different system functions by combining it with other modules. 
Thus, a component is formed out of several standardised segments. This concept of 
combining standardised modules was already used in the 13th century when stan- 
dardised stone modules were prefabricated in a quarry to form structures of gothic 
cathedrals in medieval France. Today it is the basic principle to gain flexibility for 
example in ship building, process engineering and many other fields of engineering. 

Modularisation is fostered with standardised interfaces for energy, forces, dis- 
placements and information; e.g. in the Austauschbau—being common in mass pro- 
duction, Chap. 1,—the uncertainty in geometric dimension is standardised by means 
of tolerance fields. Obviously by modularisation and standardisation the division of 
labour is fostered and the separation into the single elements of a supply chain is 
enabled. The development speed may be equally increased by integrating known 
modules into the system. The uncertainty of those modules is usually quantified. In 
some cases it is even possible to gain a legal conformity certification on the mod- 
ule level. If the module uncertainty is mastered together with the uncertainty on the 
basis of the interfaces, the system’s functionality and the objective functions can be 
quantified. 

It is self-evident that sources of uncertainty arise in the modularisation, in the 
first instance there are modules, or in the second instance there may be interfaces. 
Based on our experience the availability of a technical system is often limited by the 
failure of electrical power or signal connectors. Hence, not only the standardisation 
of the interfaces but also their robustness are most important when designing mod- 
ular systems. The robustness of the interface is fostered by obeying the above five 
inherent robust design and operation concepts. So the concept (iv), compensation of 
uncertainty, may be realised by a flexible interface. As a rule, the interface, or more 
generally speaking, the module’s boundaries should be selected in such a way that 
a module’s sub-function and quality are only marginally influenced by a detailed 
location of the boundary. This rule is exemplified in the following case study. 


4th case study—Smart modularisation of a control valve 


In this case study we address the question of how to solve the constrained optimisation problem 
formulated in Fig. 1.9b: with minimised effort subject to the function g; being fulfilled. 


N 
min YO Fi) st. g(x) <0, i=1,...,N. (3.12) 


i=l 


For this purpose, a product has to be evaluated first from the different stakeholder views. At least 
there is (a) the manufacturer and (b) the customer. In a business to business market there is often 
also (c) the planner working as a service provider and (d) the approval authority. All two or four 
stakeholders have different interests. Hence, the optimisation problem is more complex: 
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Fig. 3.19 Control valve design: a the integration of functions in a control valve hinders modulari- 
sation and increases internal and external complexity. Internal complexity may be measured by the 
number of cast moulds needed to meet the required functions. External complexity is measured by 
the different spare parts needed for maintenance. b Separation of functions enables a size ranged 
modular design of the valve reducing internal and external complexity 


N 
min ) Re) + wF? (x) + werk E) + wart; (x) | s.t. 9;(x) <0, i=1,...,N. 


i=l 
(3.13) 
Hereby, it becomes clear that the result of a modularisation strategy depends on the weights wa, 
Wp, We, Wq Of the individual stakeholder. 

Figure 3.19 gives an example of a modularisation derived form a functional integrated control 
valve typically used in the process, energy or petrochemical industry. The functional separation as 
presented in Fig. 3.19b is obviously the prerequisite for the independent size ranged modular design 
of the forged or welded tube and the cartridge insert. The functional quality is determined by the 
insert allowing a detailed design to fulfil the primary prescribed function of the valve, i.e. throttle the 
flow. The tube segment fulfils the secondary functions only and this is made possible in a wide range 
independent from the insert. The interface between the module “tube” and the module “cartridge” 
allows large tolerances being important for successful modular designs, i.e. the interface is robust 
in the above prescribed sense. Looking at the tube, it is much simpler in design and manufacturing 
compared to the cast iron casing of the traditional design. This reduces the uncertainty in the supply 
chain and shortens delivery times. Overall the customer experience with the entire numerous facets 
can be improved by smart modularisation. 
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Mastering module uncertainty by smart test and development methods 


The case study in Sect. 3.3, the “energy ship’, was motivated by the fact that com- 
bining modules with known uncertainty to build a new system enables mastering 
uncertainty. In fact that is what we observe today in the automotive industry were 
variants are derived from platforms and the platforms are based on modules. Hence, 
it is worthwhile shedding some light on smart test and development methods when 
talking about smart modularisation. 

We focus on the following concepts to master the module uncertainty: 


(i) early failure on the basis of a model test, 
(ii) scaling of uncertainty in a size ranged modular design, 
(iii) module in the loop. 


The first concept is a very easy one being part of the agile development. Despite 
the overall simulation methods we have today, we should start very early in the 
development phase to have virtual and real mock ups but also — being even more 
important—physical functional models that allow the evaluation of the expected 
functions, functional quality and general quality. The second concept is based on the 
similarity principle to derive uncertainty of a scaled prototype from the model test, 
cf. Sect.4.3.6. The third concept is widely used today. The uncertainty in function 
and quality of a module can be evaluated by integrating a real module into a virtual 
model of the system. 

Figure 3.20 shows this concept known as hardware-in-the-loop (HiL). Instead of 
integrating a new or adapted module into a real system all at once, Fig. 3.20(i), the 
module is encapsulated by an active physical interface to the cyber world, thus simu- 
lating the overall system, Fig.3.20(ii). This strategy evaluates the functional quality 
of new modular components with reduced effort and improved testing possibilities. 
The difficulty here is on the one hand the model uncertainty of the overall system 
and on the other hand the uncertainty in the flow of mass, energy and information 
between the test module and the active interface. 


Smart modules 


Instead of following the concept of smart modularisation we may think of satisfying 
a “power user” or a “power application” with only one smart module. Hypothetically, 
all the functions g1, 82, .. . shown in Fig. 3.18b could be represented in one system or 
functionally integrated module. Thus, the module is oversized for most applications; 
but in the overall picture this strategy can be advantageous with regard to the total 
effort £; F1 ;. Such smart modules were already discussed in the past in the context of 
flexibility in manufacturing [46] but only now, with the help of control theory, these 
smart modules become reality: The ability of the smart module to adapt to a specific 
application g; is necessary. This adaptivity often requires an actively controlled pro- 
cess. In the context of this book, the Active Air Spring presented in Sect. 3.6.2 or the 
3D Servo Press presented in Sect.3.6.3 are examples of smart modules. Since the 
integration of functions into smart modules will accompany us throughout the book, 
we have decided to keep this subsection short. 
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Fig. 3.20 Mastering uncertainty by stepwise integrating a module into a real system in combining 
the cyber world, with virtual modules V, and the real world, with real modules R by active interfaces. 
The interface / itself is an active component in the above defined sense. This concept is known as 
hardware- or module-in-the-loop (HiL, MiL) 


Resilience 


Again we recaptiulate the characterisation of a resilient system, cf. Sect.6.3 as 
described above: 


Aresilient system is characterised firstly by the fact that it not only fulfils a predefined function 
g like a robust system, but also retains a residual function gres, if the system is disturbed at 
time t = 0. A resilient system may secondly show the ability of recovery: from a distorted 
state, the system may recover in a time t =0,...,T to a function g(x) > g'(x") and/or 
quality F (x) > F’(x’). This function and quality may not be foreseen in the previous design 
and production phases. The design variants transform during the evolution from x to x’. 


In contrast, robust and flexible systems allow either the fulfilment of one function 
or several system functions. In both cases, i.e. for robustness and flexibility, the 
system’s functions may be uncertain. Sometimes it occurs that the function, i.e. 
the usage phase, is in part unknown when designing and manufacturing the system. 
Sometimes a system only fulfils a partial function due to an accident or a catastrophe. 

Seeing resilience as strategy to master ignorance or nescience and flexibility or 
robustness as a method to master incertitude or stochastic uncertainty is one possibil- 
ity. But this classification shows a difficulty, as the result of the classification depends 
on the degree of information on the usage scenarios which allow us to distinguish 
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between resilience and the other strategies. Hence, following this classification the 
difference between robustness and resilience is fuzzy at least in a strict scientific 
context: the transition between robustness and resilience is smooth and the use is 
determined by the context. 

However, there is also another, namely a sharper distinction between the concepts 
of robustness and resilience. More precise is the characterisation from the perspec- 
tives of the system function and the system quality measured in effort, availability and 
acceptability: a resilient system is one that still shows a residual function when heav- 
ily disturbed. On top of this, a resilient system may have the ability to evolve its own 
function and quality. As pointed out in this chapter, evolution is a time-demanding 
process. 

In fact, often this time-demanding process is commonly associated with resilience. 
Consistent with this understanding, we rather ask for the sub-functions or characteris- 
tics a system shall have to allow for the evolution of its functionality and quality from 
an initial function g, quality F associated to the design and operation parameters x 
at a time ¢ to g’, F’, x’ ata time t’: x > x’, g(x) > g'(x"), F(x) > F'(x’). 

This evolution requires sub-functions that are called resilient in a system. It should 
be able to 


(i) measure, 
(ii) react, 
(iii) learn, 
(iv) anticipate. 


The four functions can be represented by human or “smart” process chains. Depend- 
ing on the process chain and system boundaries, man and machine can work together 
as partners or independent of each other. 

There are some sequences in our mind set: For the evolution mentioned, flex- 
ibility may be a further prerequisite. Hence, we do have the understanding of 
resilience D flexibility D robustness. If we evaluate the four required sub-functions, 
there is again a sequence with (a) measure is easier than (b) react, is easier than (c) 
learn, is easier than (d) anticipate. 

Chapter 6 is devoted to the in-depth introduction of the three strategies. 


3.6 Exemplary Technical System Mastering Uncertainty 
Maximilian Schaeffner 


The theoretical considerations should equally be practically valid, verifiable and 
falsifiable. This applies especially to those methods and strategies outlined in the 
previous sections for our approach to master uncertainty in load-bearing structures 
of mechanical engineering. In particular, we have introduced methods and strategies 
for the analysing, quantifying and evaluating as well as finally mastering uncertainty 
along the product life cycle from the design via production to usage. In order to 
investigate and prove the effectiveness of our approach, it is crucial to apply the 
methods and technologies to exemplary technical systems. Therefore, technology 
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demonstrators were designed and investigated both numerically and experimentally. 
More details are disclosed in the upcoming chapters. 

Three of these technology demonstrators are introduced in greater detail in the 
following subsections. Section 3.6.1 provides an introduction of the Modular Active 
Spring-Damper System as a generic load-bearing system similar to an aircraft landing 
gear that captures a wide variety of applications. In Sect. 3.6.2 we describe the Active 
Air Spring as an active module to enable disturbance compensation in an automobile 
suspension. Finally, in Sect.3.6.3 we introduce the 3D Servo Press, which is a new 
press concept to increase flexibility and productivity in forming processes. 

The three technology demonstrators shown in Sects. 3.6.1-3.6.3 stand as pars pro 
toto for all technologies presented within this book. They render the application of 
the methods and strategies possible to analyse, quantify, evaluate and finally mas- 
ter uncertainty across all phases of the life cycle. Examples are the identifying of 
data-induced conflicts in Sect.4.2, quantifying model uncertainty in Sect.4.3 and 
evaluating resilience in Sect. 6.3. 


3.6.1 Modular Active Spring-Damper System 


Christopher M. Gehb, Maximilian Schaeffner, Robert Feldmann, 
Jonathan Lenz, and Tobias Melz 


The Modular Active Spring-Damper System (German acronym: MAFDS— 
Modulares aktives Feder-Dämpfer System) is a generic load-bearing system that 
serves as a platform for applying and testing methods and technologies to master 
uncertainty, compare Chap. 2. The motivating origin is based on an aircraft landing 
gear which reflects in particular the conflict between maintaining the main dynamic 
features, i.e. load bearing, load distribution, structural stabilisation and vibration 
control, combined with lightweight design. The investigations to describe, evaluate 
and master uncertainty are derived on a virtual MAFDS using phenomenological and 
mathematical models as well as on the physically realised structure of the MAFDS, 
see Fig. 3.21. 

The MAFDS illustrates the possibilities of mastering uncertainty in a realistic 
and descriptive manner for scientific purposes. The mechanical requirements of the 
MAFDS are largely, but not exclusively, based on those of an aircraft landing gear and 
may also capture the quarter car dynamic behaviour of an automotive chassis. Nev- 
ertheless, the MAFDS and its test environment do not intent to replace, supplement 
or extend the existing industrial and product-oriented test procedure of commer- 
cial aircraft landing gears and automotive chassis or the aircraft landing gears and 
automotive chassis itself. In fact, the findings from applying and testing methods 
and technologies to master uncertainty in load-bearing systems are supposed to be 
transferable on scientific scales to many other load-bearing systems. Said findings 
serve to increase the acceptance and credibility of the investigated methods and tech- 


3 Our Specific Approach on Mastering Uncertainty 81 


load-bearing 


methods system technologies 

(motivation) 

e topology optimisation . 2 SS e passive/active 

« Bayesian inference \ Nil vibration control 

e uncertainty quantification =f a e active stabilisation 

e uncertainty scaling 4 i e semi-active 

e UMEA and Robust Design 3 = load redistribution 

P i e integrated sensors 
landing gear ae 


7 WW <a MAFDS > 


> k i il 
aa methods and technologies 
to describe, evaluate and 
master uncertainty 
virtual real 


Fig. 3.21 Methods and technologies for mastering uncertainty in the generic load-bearing system 
MAFDS 


nologies to master uncertainty. This uncertainty to be mastered includes all forms of 
uncertainty introduced in Chap. 2. 

The virtual part comprises the methods and technologies to describe, quantify 
and evaluate the uncertainty, which means to examine the phenomenological and 
mathematical models and simulations to finally master the uncertainty [19]. These 
include e.g. investigation of topology variations in load-bearing structures that can- 
not be experimentally implemented due to the large number of possible variations. 
Furthermore, this part involves to apply and test methods, such as Robust Design, 
Uncertainty Mode and Effect Analysis (UMEA) in Sect. 5.2.1, process and uncer- 
tainty modelling, and model parameter calibration as in Chap. 4. 

The physically realised part comprises components that are constructed, fully 
realised and experimentally tested, such as the truss structures, supports, beams and 
spring-damper, compare Fig. 3.22. Due to its modular structure, the virtual as well 
as the physically realised MAFDS enable the integration of different technologies 
to master uncertainty through e.g. load redistribution, stabilisation and vibration 
control. Therefore, various passive, sensory, semi-active and active components are 
applicable for each intended process manipulation. In the following, the possibil- 
ities of sensory, semi-active and active process manipulations for the MAFDS are 
presented after the test setup and the MAFDS are introduced in detail. 


Test setup of MAFDS 
The MAFDS is a load bearing system that can be used as a passive system and 


allows for the integration of semi-active and active components due to its modular 
setup [11]. The passive structure and its components are shown in Fig.3.22a. It 
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Fig. 3.22 a MAFDS, b test setup with MAFDS; not shown is the installation of the MAFDS in a 
servo-hydraulic test rig 


consists of an upper truss structure, a lower truss structure with an elastic foot, 
guidance elements and a spring-damper. The three supports of the upper truss are 
fixed to a load frame that guides the MAFDS in vertical direction for experimental 
drop tests, see Fig. 3.22b. Additionally, it is possible to install the MAFDS in a servo- 
hydraulic test rig in order to apply base excitation, see Fig. 3.29 upper right picture. 
By this means, we realise a defined frequency excitation and e.g. road excitation. 
However, this section focuses on the drop test setup. 

The upper truss consists of four tetrahedron modules with slender beams and solid 
nodes, of whom one is highlighted in Fig. 3.22a. The individual beams can be easily 
exchanged by sensory, semi-active or active beams, as presented in Sects. 5.3.6, 5.4.6 
and 5.4.7. The four tetrahedron modules are linked to each other, yielding the upper 
truss structure. The lower truss of the MAFDS consists of one tetrahedron module. 
An elastic foot and an additional mass are attached to the lower node to represent 
the stiffness and the inertia of a wheel of an air plane landing gear or a car. 

The dynamic behaviour of the MAFDS is governed by the properties of the spring- 
damper. For the application in the MAFDS, the passive suspension strut of a mid- 
range car serves as a spring-damper that is connected to the upper and the lower truss 
via a torque-free connection. 

In order to enable the relative translation of the upper and lower truss structures 
in vertical direction, both are connected by three kinematic guidance elements. The 
design and position of the three guidance elements allow for simultaneous trans- 
mission of the transverse forces and bending moments between the lower and upper 
truss. In this way, the spring-damper is not charged with transverse forces or bend- 
ing moments. Thus, the absorption and dissipation of impact energy and the low- 
frequency vibration reduction mostly take place via the spring-damper. A simple two 
degree freedom (2 DOF) model of the MAFDS to capture its dynamic behaviour will 
be presented in Sect. 4.3.3. 


3 Our Specific Approach on Mastering Uncertainty 83 


. * strain gauge 


force sensor 
a 


Fig. 3.23 MAFDS and its sensors and selected measured quantities [13] 


The test setup used for the experimental testing of the MAFDS is depicted in 
Fig. 3.22b. It consists of a rigid test setup frame attached to a vibration foundation. 
Parallel guidance rails are mounted on the test setup frame and enable a low-friction 
vertical movement of the load frame that can translate along the guidance rails. The 
test setup enables the introduction of static as well as dynamic loads, the latter via 
drop tests of the MAFDS. These are carried out in a similar way as to landing gear 
tests. After the load frame with the MAFDS attached to it is lifted up to a desired 
drop height h as depicted in Fig.3.23, the load frame is released for a drop test. 
Additional weights maqa can be added to the load frame, similar to varying loads 
of an airplane or a vehicle. The deterministic, but varying input quantities shall 
induce data uncertainty into the system, as defined in Sect.2.1. The drop height h 
and the added mass maqa thus constitute the inputs to the experimental drop tests. 
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Table 3.1 Input combinations of added mass mada and drop height h as well as resulting number 
of drop tests, upright and tilted configuration possible 


Madd in kg hinmm Number of drop tests 
0 10, 20, 30, 40, 50, 60, 70, 80, 90 9x5 
10 10, 20, 30, 40, 50, 60, 70 7x5 
20 10, 20, 30, 40, 50, 60 6x5 
40 10, 20, 30, 40, 50 5x5 
60 10, 20, 30, 40 4x5 
80 10, 20, 30 3x5 
100 10, 20 2x5 
N = 180 


Additionally, MAFDS can be tilted by an angle in direction of each of the three 
fixed supports of the upper truss. Thus, it is possible to introduce lateral forces into 
the elastic foot. For the studies presented in this book, N = 180 experimental drop 
tests were carried out and measurements taken accordingly. In Table3.1, the input 
combinations and respective repetition of measurements are shown. The drop tests 
specified in Table 3.1 were conducted for the MAFDS in an upright position as well 
as tilted in three different directions. 

In order to capture the dynamic behaviour during the drop tests, the MAFDS is 
equipped with a comprehensive set of sensors to measure forces, bending moments, 
strains and displacements. Selected sensor positions are shown in Fig.3.23. The 
forces at the three fixed supports, Fig.3.22a, where the upper truss of MAFDS is 
connected to the load frame, are measured via triaxial piezoelectric force sensors. 
Normal and bending strains are measured using strain gauges attached to selected 
beams of the upper and lower truss. The locations of the strain gauges are indicated 
with ellipses in Fig. 3.23. The force between the spring damper and the upper truss 
is measured by a uniaxial strain-based force sensor and is denoted by the spring- 
damper force Fa. The impact force that the elastic foot of the MAFDS exercises on 
the vibration foundation during the drop tests is measured by a triaxial strain-based 
force sensor with its vertical component being denoted by the elastic foot force Fer. 
Furthermore, the relative displacement between the upper and the lower truss is 
measured using displacement sensors being denoted by z,. Exemplarily, Fig. 3.24 
shows measurements of the relative compression z,, the spring-damper force F,g and 
the elastic foot force Fr for a drop test with zero additional weight maga = Okg and 
drop height A = 0.09 m, where the peak values Zr peak, Fef,peak and Fya,peak are marked. 

Using the measurements of the MAFDS, the dynamic behaviour and aspects 
related to data uncertainty and model uncertainty (see Sects. 2.1 and 2.2.2) are further 
investigated in Sects. 4.2.3 and 4.3.3. 
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Fig. 3.25 Technologies for mastering uncertainty in the MAFDS by semi-active and active process 
manipulation: a semi-active guidance elements for load redistribution, Sect. 5.4.8, b beam with 
piezo-elastic supports for active buckling control, Sect. 5.4.7, and (semi-)active piezoelectric shunt 
damping, Sect. 5.4.6, e sensory rod for condition monitoring, Sect. 5.3.6; not shown is the Active 
Air Spring presented in Sect. 3.6.2 


Semi-active and active process manipulation in the MAFDS 


So far we have presented the design of the passive MAFDS that is used to quantify 
and evaluate uncertainty in a generic load-bearing system. In addition, the modular 
structure of the MAFDS allows for the possibility to modularly exchange sensory, 
semi-active and active components in order to master uncertainty within the usage 
phase, see Sect. 3.1. The technologies were developed as individual systems and 
validated in component tests, as described in detail in Sect. 5.4. Exemplarily, Fig. 3.25 
shows three different technologies that can be integrated into the MAFDS to master 
different sources of uncertainty being present during the usage phase of the MAFDS. 

In a new concept for load redistribution, compare Sect.5.4.8, the semi-active 
kinematic guidance elements presented in Fig.3.25a are used to influence the load 
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path of the MAFDS, e.g. in a drop test. Thus, the guidance elements between the 
upper and lower truss structures of the MAFDS are enhanced with a new dynamic 
function beyond the original kinematic one. Innovative piezo-elastic beam supports 
for beams with circular cross-section are shown in Fig. 3.25b. In one application, the 
piezo-elastic supports are used for active buckling control of axially loaded beam- 
columns in the upper truss of the MAFDS to increase the load-bearing capacity of 
the upper truss structure, Sect.5.4.7. In another application, they are used for the 
attenuation of lateral beam vibrations within the truss structures of the MAFDS 
by piezoelectric shunt damping, Sect. 5.4.6. Figure 3.25c depicts a sensory rod with 
integrated strain gauge sensors to monitor the load status of individual beams in the 
truss structure of the MAFDS, which is manufactured using incremental forming 
processes, Sect.5.3.6. 

Further technologies, which can be integrated into the MAFDS, but are not shown 
here, are the passive vibration control by a spring-damper with integrated hydraulic 
vibration absorber; this is an alternative to the passive spring-damper of the MAFDS, 
Sect.5.4.4, and further the active vibration control of the MAFDS by the Active Air 
Spring, which is presented in detail in Sects.3.6.2 and 5.4.5. 

Thus, the modular structure of the MAFDS allows the numerical and experimental 
testing of passive, sensory, semi-active and active technological measures to master 
the uncertainty during the usage phase of the MAFDS. These technologies are inte- 
grated into the MAFDS and tested in different load scenarios analogue to the passive 
MAEDS, see Table3.1. By comparing the passive structure to the sensory, semi- 
active and active versions of the MAFDS, the mastering of uncertainty is verified 
and validated within the MAFDS. 


3.6.2 Active Air Spring 
Manuel Rexer and Peter F. Pelz 


Suspension systems in automobiles determine the driving comfort for the passengers 
as well as the driving safety of the vehicle. Currently, two trends are crucial for future 
suspension systems. Firstly, the trend towards autonomous driving is increasing the 
demands on driving comfort, as passengers are able to engage in other activities 
and thus may suffer more frequently from kinetosis [26, 48]. Secondly, the limited 
electrochemical energy storage of future vehicles requires energy-efficient passive or 
active suspension systems. This section discusses how both functional requirements 
can be met by the Active Air Spring, which has been developed and validated over 
the last 12 years. 

It is helpful to understand the function of a suspension system before starting 
modelling or even designing. The suspension system of a vehicle performs four 
functions, i.e. (i) carrying the vehicle load, (ii) levelling the distance between the 
vehicle body and the road, (iii) isolating the body from road or vehicle dynamic 
excitations and (iv) limiting the dynamic force amplitude of the wheel. These four 
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functions should be achieved with the least amount of packaging space, weight, 
energy and cost. Furthermore the four functions should be achieved robustly, i.e. 
even for uncertain loading or excitation or more general, even for uncertain customer 
expectations. There are two important quality measures: first, the functional quality 
as one measure of acceptability; second, the effort measured in energy consumption 
needed to achieve the functional requirement. Both are addressed in the following 
section. 


Prevailing passive and semi-active systems 


For economic reasons, the levelling function (ii) is usually not fulfilled in conven- 
tional passive suspension systems. A coil spring enables functions (i) and (iii) with 
minimal costs. Due to the periodic shift of potential energy from the coil spring 
with stiffness k, to the kinetic energy of the chassis of mass my and vice versa, the 
system exhibits a natural frequency w» = ./ky/my. Above an excitation frequency 
Q > VD, the road excitations are isolated as desired. To limit resonant oscillations 
at Q ~ w and to fulfil the functional requirement (iv), namely to limit wheel load 
oscillation, a hydraulic damper is connected in parallel as a dissipative element. It 
is immediately apparent that the outlined and prevailing solution is not robust with 
respect to the uncertainty of the chassis mass mp. This is due to the non-separate 
functions (i) and (iii). 

Air suspension and hydro-pneumatics are more complex and costly suspension 
systems. Both enable the levelling function (ii). However, as discussed in Sect. 3.5, 
true separation of functions as one of seven inherently Robust Design principles is 
only realised in air suspension. Even with air suspension, the two functions of (iii) 
isolating the structure from road or vehicle dynamic excitations and (iv) limiting 
the dynamic force amplitude of the wheel are in conflict, as we show below using 
a dynamic vehicle model. Only the Active Air Spring, as one example of a smart 
module as discussed in Sect. 3.5 makes it possible to satisfy new demands resulting 
from the trends mentioned at the beginning of this section. 


Pareto optimal passive and semi-active systems versus Pareto optimal active 
suspension system 


In the case of conflicting tasks, Pareto-optimal solutions emerge. Indeed, we show 
that the Pareto line cannot be crossed by any active or semi-active state-of-the-art air 
or hydro-pneumatic suspension systems. In such systems, the spring force kp (z, t)z 
and damper force b» (z, t)z can be controlled by pneumatic or hydraulic valves. Here, 
Z = Zw — Zp denotes the compression of the suspension system and 7 the time, cf. 
Fig. 3.26. 

Our research is carried out on three quarter car models, a virtual one, a hardware- 
in-the-loop system, cf. Sect. 4.3.4, and a real system. The latter is comparable to the 
MAEDS, Sect. 3.6.1, being a two-mass oscillator as well. The equation of motion of 
the system depicted in Fig. 3.26 is given by the following two equations of motions 
and the constitutive equation for the passive force change A F: 
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Fig. 3.26 Quarter car model for vertical dynamics of a passive, b semi-active and ¢ active suspen- 
sion systems with the energy flow across the system boundary 


m (Zp + 8) = Fo + AF) + AF, (3.14) 
My Zw + kw (Zw =? Zr) + by (Zw id Zr) = (AF, + AF,) p (3.15) 
A Fp = kp (Zw — 2b) + Do (Zw — żb) . (3.16) 


Here, AF, is the active force between the body and wheel and Fo = mpg is the 
static preload of the suspension system with the mass specific gravity force g. We 
assume linear springs (stiffness k) and dampers (damping constant b) and a foot point 
excitation z,. 

The passive, Fig. 3.26a, and semi-active system, Fig. 3.26b, consist of a spring and 
a damper connected in parallel between body mass, m» and wheel mass mw without 
any active force AF, = 0. 

For a semi-active air spring being state-of-the-art today, the stiffness kp is adapted 
by increasing the air spring volume Vọ by means of switching pneumatic valves. 
For semi-active damping systems the damping constant bp is adapted by switching 
hydraulic valves. 

Here, the focus is on the active force A F, on the right side of the equations. Today 
there are no Active Air Springs in usage. Figure 3.26c shows the active suspension 
system. An active system can react to uncertainty from the usage phase and, for 
example, compensate the loss of comfort as we investigate in Sect.5.4.5 using the 
example of the Active Air Spring presented here. When tuning a spring-damper 
system, the objectives of driving comfort and safety are in conflict because it is not 
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Fig. 3.27 Conflict diagram of driving safety and driving comfort with passive and active boundary 
lines as well as isolines for constant stiffness and constant damping of a passive suspension for a 
quarter car driving on a highway at 100 km/h [20] 


possible to keep both constant at the same time, the force between the wheel and 
the ground and the body at rest. Hard-tuned sporty vehicles, for example, offer low 
driving comfort. As a result, a compromise must be found between the two target 
parameters during the tuning process. Mathematically, this conflict is described as a 
minimisation of body acceleration and wheel load fluctuation 


min (0(&)” + ao(Fw)’) . (3.17) 


The two objectives driving comfort and driving safety—described by the standard 
deviation of the body acceleration o (Zp) and the standard deviation of the wheel load 
fluctuation o(F,,) — are weighted via the parameter a. 

Figure 3.27 shows the conflict diagram for the quarter car where the standard devi- 
ation of body acceleration o (Zp) is plotted versus wheel load fluctuation o (Fy, / Fw,o) 
with the dynamic wheel load Fw = kw(Zw — Zr) + Dw(Zw — Zr) and the static wheel 
load Fw,o = (mp + my)g [34]. Table 3.2 lists the parameter of the passive reference 
car with a passive linear spring-damper system. The car is excited by a stochastic 
road signal z; according to a ride on a highway at 100 km/h [34]. 

The Pareto line for the passive system, shown in Fig. 3.27 represents the optimal 
tuning of the spring-damper system of the passive suspension according to Eq. (3.17) 
with the curve parameter 0 < a < oo. This Pareto line cannot be crossed by varying 
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Table 3.2 Parameters of the quarter car model of the passive reference car according to a middle- 
range car [20] 


Parameter Value 

Body mass mp 290 kg 
Wheel mass my 40 kg 

Body stiffness kp 10000 N/m 
Body damping bp 1140 Ns/m 
Tyre stiffness kw 200 000 N/m 
Tyre damping bw 566 Ns/m 


the body stiffness and damping of the system as shown by isolines for body stiffness 
and damping. 

Figure 3.27 also shows the Pareto line for the ideally controlled active system. 
This system has no limit for the actuating power P,, cf. Fig.3.26c. As shown, the 
functional quality can be significantly improved by an active system. Nevertheless, 
there is still a conflict between the two targets driving comfort on the one hand and 
driving safety on the other hand when tuning this system. It is not possible to keep 
body and wheel at rest at the same time while the system is externally excited. But 
still, the use of an active system makes it possible to improve both driving comfort 
and safety and thus to overcome the limits set by the Pareto line of the passive system. 
In addition, active systems have an extended working range compared to passive or 
semi-active systems. Due to their variability in force setting they are well suited in 
mastering the mentioned uncertainty. 


Sustainable active suspension demands low viscous or Coulomb friction 


From Newton’s third law “actioni contrariam semper et aequalem esse reactio- 
nem” [35], known in short as ‘actio est reactio’, it follows that the axial compression 
force of the air spring is given by 


F(t) = [p() — pelA(t). (3.18) 


This equation applies, provided that the pressure distribution within the component 
is homogeneous, which is usually the case [38]. In any case, Eq. (3.18) applies if the 
static pressure p(t) is the volume-averaged pressure in the component and pe is the 
ambient pressure. For a piston or plunger, the load-bearing area A(t) is equal to the 
plunger cross-sectional area. For a rolling lobe or bellow, the load-bearing area A(t) 
is bounded by a closed curve along which the stress vector has no component in 
the compression direction, cf. Fig.3.28. For the Active Air Spring in focus here, the 
load-bearing area does depend on time r. It is obvious that this can only be achieved 
by a compliant component. The innovative core of the Active Air Spring presented 
here is the active inner support of the bellow, cf. Fig. 3.28b. 
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Fig. 3.28 Schematic sketch for a bellow sealed air spring with radius of the load-bearing area rı, 
b actuated piston and edouble bellow Active Air Spring [20] 


For the system at rest at the design point, the spring force is in equilibrium with 
the gravitational force of the body mass mpg : Fo = (po — Pe) A = mpg. The index 
O marks the design point. 

Transiently, the pressure p(t) within the component can change due to a com- 
pliance C, a resistance R or an inductance L or a combination of those effects. 
In a pneumatic or hydro-pneumatic suspension, the above-mentioned load-bearing 
function including the levelling function is fulfilled by the fluidic component. The 
pressure p is adjusted quasi-stationarily for load levelling, cf. Sect.3.4. This is made 
possible by a gas compressor in the case of an air spring, and by a displacement 
pump in case of hydro-pneumatics. 

In the Active Air Spring presented here and in Sect.5.4.5, the gas compliance C 
enables the second function mentioned above, the energy storage function. Inherent 
(passive) damping R makes every active system energetically inefficient since the 
actuator has not only to supply the required energy to the system, but also has to 
overcome internal frictional, i.e. damping forces. Thus, in the following, damping 
forces, viscous or Coulomb, are usually considered parasitic in the context of the 
Active Air Spring and Fluid Dynamic Vibration Absorber (FDVA) introduced in 
Sect. 5.4.4. 
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Passive, semi-active, and active pneumatic suspension system 


The total force given by Eq. (3.18) can be split into three parts F(t) = Fo + 
AF, (t, Fo) + AF, (t, Fo). The force Fo = mpg conditions the load-bearing function 
of the suspension system. The passive force change AF, (t, Fo) is mainly conserva- 
tive, i.e. results in transient storage of potential energy. If damping is required, e.g. 
for a passive or semi-active system, the passive force change can also be partially dis- 
sipative. For a coil-spring or hydro-pneumatic suspension system, the passive force 
change AF,(t, Fo), i.e. the energy storing function, depends on the preload Fo of 
the system. The load-bearing and energy-storing functions are therefore not sepa- 
rate. According to Sect. 3.5, an inherently Robust Design concept is the separation of 
functions, cf. also 3rd case study in Sect. 3.5. This demanded separation of functions 
is only achieved in the case of air suspension with load levelling: 


F(t) = Fo + AFG) + AFA (0). (3.19) 


The difference between the active suspension on the one hand and passive or semi- 
active suspension on the other hand, as discussed in Sect.3.3, becomes clear when 
looking at the energy flux per unit time across the system boundary marked by a 
broken line in Fig. 3.26c. 

Three energy flows must be taken into account. Firstly, the mechanical work Pa = 
P,(AF,), which acts on the suspension system per unit time through the actuator 
of the active component. The power P, can be positive or negative, i.e. supplied 
or extracted. Secondly, the excitation work per unit time P, = P,(F,) = vD,, which 
results from the movement of the vehicle along a bumpy road (amplitude of the waves 
2.) with velocity v. In the latter case, the energy is taken from the drive system, which 
is needed for overcoming the additional drag force D,. This force is additive to the 
rolling resistance of the wheels, which is essentially determined by viscoelastic- 
plastic deformation within the wheel elastomer and between the tyre and the road 
surface, and by the air resistance. Thirdly and finally, the energy dissipated in the 
damper per unit time is Pa( Fa) = —|Q|. This power is always negative due to the 
second law of thermodynamics. It results in a heat flux Ò. Thus, the first law of 
thermodynamics for any load-bearing system reads 


TA passive/ 
FF) = Q| semi-active, (3.20) 
P,(AF,) + P,(F) =|Q| active. 


P,(AFa) + P(F) = |Q| > 


Equation (3.20) is the foundation for classifying active systems on the one hand 
and passive or semi-active systems on the other hand, cf. Sect.3.4. From the first 
energy balance vD; = P,(F;) = | QO] itis easy to derive an upper limit for the energy 
consumption due to the (a) passive or (b) semi-active suspension system. Neglecting 
dissipation due to the tyre, for both cases the energy equation reads 
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2r 2a 
vD, = f ky (Zr = Zw) Zr d(Qr) = f br? d(Qr) . (3.21) 
0 0 


The angular excitation frequency Q = (2rv)/A is determined by the wave length A of 
the road waviness and the driving velocity v. To simplify the calculation, we assume 
My X my. Therefore, the relative compression can be approximated by z = Zw — 
žb © Zw. For this case, the last integral, i.e. the power loss is given by | O| = ab. 
The first integral, i.e. the work exerted by the road on the suspension system, is in 
any case less than or equal to kyZw2,S2. The power needed for moving a vehicle 
along a bumpy road is 

m k22? 


D = D, + air drag + rolling resistance, D, < — p (3.22) 
Vv Dh 


Both air drag and rolling resistance increase with v, while the resistance due to the 
suspension system decreases with v. This is because the passive damper becomes 
dynamically stiffer with increasing speed. In the asymptotic limit of Q — ow, the 
suspension system becomes energetically conservative: energy storage takes place 
in the tyre alone. 

If only the energy efficiency is taken into account, the damper would have to 
be replaced by a rigid bar. This is of course nonsensical, as the conflict diagram, 
Fig. 3.27, indicates. There, the two previously ignored functions of a suspension 
system are given as coordinates. These are the relative wheel load variation as a 
measure of driving safety and the body acceleration as a measure of driving comfort. 

Before we arrive at that point, we discuss the difference between (a) a passive and 
(b) a semi-active system both sketched in the above Fig. 3.26. For both systems there 
is no active force, AF, = 0. For (a) a passive system, the parameters bp, kp, bw, kw of 
the ordinary differential equations, Eqs. (3.14)-(3.16), are constant. For a (b) semi- 
active system, the parameters b,(t), kp (t) may vary with time. A semi-active damper 
or a semi-active air spring enables this. For the first case, the damping constant is 
changed by adapting the valve opening. For the second case, the spring constant is 
adapted by adapting the gas volume Vp without performing mechanical work on the 
gas. The adaption is reached by opening or closing a pneumatic valve connecting 
adjacent volumes. For a cyclic excitation, the stiffness is kp(t) = kp(t + T), were 
T = 27/2 is the cycle time. Hence, for the semi-active air spring, the suspension 
system is described by the Hill and Mathieu differential equation [18] 


my +ky(t)z=0. (3.23) 


It is important to emphasise that the body movement can only be ideally isolated 
from the movement of the wheel with (c) an active system. This may be achieved by 
dynamically balancing the spring force (and by balancing a parasitic damper force) 
with the controlled active force A F(t). From Eqs. (3.14) to (3.16) it follows that 
if the active force is controlled according to the rule AF,(t) = kyz = kp (Zw — Zb), 
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there will be an ideal isolation, i.e. Zp = 0. Ideal isolation becomes more and more 
important for future autonomous vehicles. 

The additional drag D,, present in the passive and semi-active system, can be 
reduced by an active system. In an ideal active system there is no damper. Hence, 
|O| > 0 and D, — 0 for the ideal active system. In the following we analyse pos- 
sibilities given by air suspension or hydro-pneumatic suspension. 


Active and passive means of changing the compression force 


To separate active and passive physical effects of changing the compression force, 
we take a look at the logarithmic derivative of the compression force F, Eq. (3.18), 


= ir, (3.24) 


Replacing the increment d by the difference A at the design point, we get 


AF Ap AA 


DN 


x goa. (3.25) 
Fo Po— Pe Ao 


In general, for the active system we have in Equation (3.24) dp = dp, + dp, and 
dA = dA, + dA,. Only the active adjustments requires external energy. The passive 
adjustments for both pressure and load-bearing area are resulting from the relative 
compression z = Zw — Zp Of the spring. A contoured support of the rolling lobe 
either in form of contoured piston or a contoured outer guidance, results in A(z), 
cf. Fig. 3.28. For instance, the load-bearing area is by predefined kinematics a function 
of the compression z. It follows that 


dA 
dA=dAp+dA,= 5] de+dA, = A'dz + dAy. (3.26) 
Z 


a 


Analogously, the change in gas pressure d p may have a passive and active part: dp = 
dp, + dpa. In an asymptotic and hence simplified model, the change in pressure may 
be isentropic, s = const, or isothermal, V = const, cf. Sect.4.3.5. The former is a 
good model for ‘fast’ processes, i.e. the cycle time T must be much shorter than 
the thermal relaxation time of the gas. The latter is a good model for ‘slow’ active 
systems. The load-levelling function of an air spring enabled by a compressor is such 
a slow active system. Here, there is sufficient time for thermal relaxation of the gas 
to the ambient temperature. It should be emphasised that only for preliminary design 
studies, the isentropic or isothermal asymptotes are needed. For observer models the 
thermal relaxation can easily be calculated, cf. Sect.4.3.5. 

For both, the ‘fast’ and ‘slow’ process, the change of the thermodynamic state is 
barotropic, because for both cases the pressure is only a function of the gas density: 
p = p(o, s = const) or p = p(o, V = const). The volume averaged pressure p is 
hence only a function of gas volume V and the gas mass m. The gas mass can only 
be changed (iii) actively by means of a compressor transporting gas from the ambient 
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into the pressure chamber: dm = dm,. The gas volume is changed (i) passively when 
the air spring is compressed; the gas volume may be changed (ii) semi-actively by 
opening or closing a valve connecting the gas volume to an additional gas volume; 
finally, the gas volume may be changed (iii) actively by means of moving a piston 
against the gas pressure within the air spring. The passive and active means sum 
up to dV = dV, + dV,. With the displacement area Aq defined as Ag := —dV/dz 
the pressure change is given by 


ð 
(—Aadz + dV) + 2 


agl, Ma (3.27) 


Vo 


From this, the logarithmic derivative, Eq. (3.24), of the compression force, Eq. (3.18), 
becomes 


dF ( Aa OP), 2): gil =, OB) ay 
— Zz — a 
F — Pe OV A — Pe OV 
P-P m,s P = > m,s i (3.28) 
ep dm, + a 
P=Pe OM\y 4 A 


For the design point we have Ag > Ago, A— Ao, A’ > Al, p> po, F > 
Fo = poAo, m — mo. Hence, for the ‘fast’ change of the gas volume and the ‘slow’ 
change of the gas mass we have the asymptotic limits according to Sect. 4.3.5 


Op A po Op 
AV las Wo Om 


p (3.29) 


V,# mo 


Here, the isentropic exponent is denoted by y. Hence, the logarithmic derivative 


becomes 
AF AF, AF, Az AF, 
= + =kp + : (3.30) 


with the abbreviation for the stiffness 


AF A Al 
kp := Z = mg (+ po a 2) (3.31) 
Po — Pe Vo Ao 


and the active force contribution 


AF, Am,  AVU\ AA, 
en (= ) (3.32) 


Fo Po— Pe \ mo Vo Ao ` 


Inherent robust design concept of the Active Air Spring 


From the stiffness, Eq. (3.31), we recognise the independence of the body natural 
frequency from the body mass m» for po > pe (this condition is usually fulfilled) 
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provided Vo is controlled to be constant by means of a levelling function, i.e. a 
compressor as actuator, 


kp Aao A 
= 3.33 
-J£ -Je Vo +3) oo 


Thus, the system is inherently robust due to the separation of the two functions, 
first storage of potential energy and second levelling the body relative to the wheel 
to a predefined distance. As such, it is self-adaptive to load changes, meaning it 
compensates for uncertainties in the load. This is the reason why air suspension is 
standard in commercial vehicles and rail cars. The three principles of ‘separation of 
functions’, ‘self-adaptation’, and ‘compensation’ are three of the seven inherently 
Robust Design concepts discussed in Sect. 3.5. 

From Eqs. (3.20) to (3.25) we recognise the semi-active nature of air springs with 
several volumes: by adapting the volume Vo, the stiffness and by that the dynamic 
behaviour is changed. But the semi-active control fails in preventing motion sickness. 
Thus, the following section discusses how to achieve an active force A Fy. 

For the active system, the relevant cycle time is T = 2r /w» ~ 1 s. Changing the 
gas mass Am, in acomparable time is not feasible. Hence, changing the gas mass is 
limited to the levelling function of the suspension system. Dynamically adapting the 
gas volume AV, may be achieved by pumping oil, e.g. by a gear pump, as is done 
for hydro-pneumatic suspension systems. For an air suspension system to become an 
Active Air Spring, only the adaption of the load-bearing area is feasible [6]. Hence, 
for ‘fast’ cyclic forces AF,(t) = AF,(t + T). Equation (3.32) reduces to 


AF, = poAAa. (3.34) 
Milestones in 12 years development of the Active Air Spring 


Figure 3.29 shows the milestones in twelve years of development of the Active Air 
Spring as a time line. From the idea, the development led via a first prototype, which 
realises the adjustment of the load-bearing area via a hydraulically driven cam gear [4] 
to the second prototype with two connected hydraulic membrane actuators [20]. We 
were able to significantly reduce both the package and the weight of the prototype. 
The result is a hydraulic diaphragm actuator that is completely integrated into the pis- 
ton of the Active Air Spring (Fig. 3.32). To ensure the relative force change A Fa/ Fo 
is as large as possible, a double bellows air spring is used. Figure 3.28c shows the 
structure of two pistons connected by a rod. The load-bearing area thereby describes 
a circular ring. 

Both pistons are equipped with an actuator allowing a total force change of 
AF, © +1kKN at a static load of Fo = 2850N. A further advantage of the double 
bellow Active Air Spring is the hydraulic coupling of the two actuators via a double 
acting cylinder. As a result, the energy requirement of the air spring is reduced, as 
only differential forces have to be set, comparable to a mechanical rocker [43]. Fur- 
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Fig. 3.29 Milestones in the development of the Active Air Spring [21, 22, 39] 


thermore, energy can be recuperated by resetting the actuators through the bellows. 
Figure 3.30 shows the concept of the Active Air Spring including two actuator pis- 
tons and the hydraulic coupling. The actuator can be driven by different operating 
principles. A hydraulic drive is used for the technical prototype. 

Table 3.3 gives the main characteristics of the developed Active Air Spring spring. 
Figure 3.31 shows the designed second prototype according to these parameters. 

The two actuators are the core of the Active Air Spring. They work as single-acting 
hydraulic linear actuators. The reset is done via the bellows and the pressure in the 
air spring. In order to distribute the load on the bellows, the piston is divided into four 
segments [5], each moves radially up to +3 mm [22]. These segments are guided by 
piston rods which are mounted in the piston via sliding bushes. Diaphragm cloths 
seal the actuators with low friction and without leakage [22]. Figure 3.32 shows the 
structure of the upper actuator. 

Influencing factors on the performance of the active suspension system are 


1. the maximum velocity at which the actuator forces can be adjusted, 
2. the maximum actuator force A Fy, max and 
3. the control concept and the selected controller. 
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Fig. 3.30 Double bellow Active Air Spring with connected hydraulic actuators [20] 


We considered all these factors in the development of the technical prototype. The 
uncertainty in the design parameters, such as the body mass for example, was taken 
into account in the sense of a resilient product development [25]. 


In the following, we present the results necessary for an optimal design and 


operation of the Active Air Spring. 


1. 


2. 


Actuator Velocity. Active suspension systems can be divided in slow active sys- 
tems working up to 5 Hz and fast active systems working up to 30 Hz. We showed 
that a slow active system is sufficient to improve driving comfort and avoid kine- 
tosis [20]. The transfer function of the developed actuator corresponds approxi- 
mately to a first order low pass filter with a cut-off frequency of 5 Hz [23]. 
Actuator Force. We showed that an actuator force of about 1 KN is sufficient to 
influence the vertical dynamics of a car with the properties shown in Table 3.2 [20]. 
With more available force, the driving comfort is not further improved. 


. Controller. The control concept consists of a primary controller that specifies 


the actuator force and a secondary controller that controls the realisation of the 
required actuator force via the hydraulic diaphragm actuators [20]. The struc- 
ture and parameters of the primary control loop determine the performance of 
the active system. We designed the controller via an H2-optimisation [32]. The 
resulting controller structure includes a skyhook controller combined with a pre- 
view function. The preview function significantly increases the performance of 
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Fig. 3.31 Technical prototype of the Active Air Spring [20] 


the active system. This results in almost the ideal active system [32]. Therefore the 
road excitation z, with velocity z, and acceleration Z, as well as the body velocity 
Zp is fed back statically. More complex dynamic controllers are not used due to 
stability reasons [24]. Table 3.4 lists the implemented controller parameters. 

The designed controller is robust against uncertain parameters such as varying 
body mass my or wheel stiffness kw. Figure 3.33 shows that the results are always 
close to the active Pareto line. The controller is designed with the nominal con- 
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Fig. 3.32 Sectional view of the hydraulic diaphragm actuator with four segments [20] 


figuration shown in black. The Pareto lines for active systems are recalculated for 
each configuration as a reference. The controller is also robust against uncertainty 
in excitation as shown in Sect. 5.4.5 and [24]. 


The example of the Active Air Spring is used in several chapters throughout this 
book. The possible improvements in driving comfort with the active suspension 
system are presented in Sect.5.4.5. These experimental investigations were realised 
on a hardware-in-the-loop test rig. The model uncertainty of these tests is shown in 
Sect. 4.3.4. The actuator is also used as an example of a resilient process chain (see 
Sect. 6.3.7). 


3.6.3 3D Servo Press 
Maximilian Knoll, Florian Hoppe, and Peter Groche 


Forming machines are used to provide forming forces and energies required to form 
and guide the tools. Depending on the requirements, individual types of machines are 
used. Due to fluctuations on the downstream market, the requirements for products 
and thus the forming processes can vary tremendously. As forming machines come 
with a high investment, it is important to predict future requirements and select 
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Table 3.3 Important characteristics of the Active Air Spring [20] 


Parameter Value 

Static load Fo 2850N 

Actuator force A F,(z = 0) +1180N 

Static pressure po 14 bar(a.) 

Total load-bearing area Ao (2195 + 910) mm? 
e maximum deflection Zmax +70mm 

Air spring volume Vo 2.21 
Upper piston 

Piston diameter dp,1 (105 + 6) mm 
Outer diameter ds ı 140mm 


Load-bearing area A, 


(11.740 + 570) mm? 


Segment high eg, ı 76mm 
Lower piston 

Piston diameter rp,2 (94 = 5) mm 

Outer diameter ro,2 127 mm 


Load-bearing area Aa 


(9545 £ 340) mm? 


Segment high Aseg,2 


76mm 


Table 3.4 Implemented skyhook controller with preview 


Parameter 

—1750Ns/m 
kz, —3860 N/m 
kz —1016 Ns/m 
k 


—18.29 Ns? /m 


102 P. F Pelz et al. 


an optimal machine type. Usually the machine types are divided into force-driven, 
path-driven and energy-driven machines. All of them have in common that they 
move a press ram which guides the tool along a horizontal or vertical axis. While 
energy-driven machines, e.g. hammers, provide a defined forming energy in terms of 
kinetic ram energy, force-driven machines, e.g. hydraulic presses, provide a specific 
maximum force over the complete ram motion. The actual ram motion is then defined 
by the input energy or force and the reacting forces. In contrast, a conventional 
path-driven machine consists of an electric drive, a clutch, flywheel and crank drive; 
therefore it provides a predetermined pattern of ram motion [54]. The non-modifiable 
pattern of ram motion (e.g. sinusoidal) limits the fields of application. 

By integrating servo drives, new types of presses have been introduced to over- 
come these limitations. These servo presses allow the ram motion to be adjusted by 
means of control systems and algorithms. However, these machines so far only allow 
ram movements in one direction. To achieve more demanding geometries to make 
use of properties difficult to deform, special machines or complex tool designs are 
often unavoidable. 

One prominent case of special processes is orbital forming. During orbital forming 
a tool with small contact areas rolls over the workpiece and progressively shapes it [8]. 
Forming forces are reduced drastically in orbital forming presses, the translatory ram 
motion is extended by an additional rotary motion. While the translatory ram motion 
can be freely programmed, the rotary motion can be adapted to the process only in 
restricted levels. 

Classical path-driven presses with a one-dimensional motion are designed for 
high productivity and have proven their value over the last decades. Especially path- 
driven presses with flywheel are able to produce a huge number of parts per minute. 
But they are limited to one degree of freedom ram motion. Today’s servo presses 
provide an increased flexibility, as described in Sect. 6.21. 

But they are not able to offer motion patterns which special presses use to get the 
most out of the individual forming process. 

As seen from the previous paragraphs, classical and special presses either offer a 
high productivity or specialised motions. After an investment decision for a forming 
machine is made, the flexibility with respect to motion pattern and productivity is 
very limited. But due to uncertain conditions and requirements on the upstream 
and downstream market, modern production systems should be able to switch over 
to a multitude of processes and process chains. This is only possible through the 
cost-intensive acquisition of different machine types. 

Furthermore, disturbances that occur during production, such as varying material 
properties, are difficult to control. Since existing machine concepts only offer very 
limited possibilities to compensate for these, tight tolerance requirements are set for 
material and process parameters which are continuously monitored. Yet, increasing 
the adaptability of the process has been accompanied by productivity reductions and 
the installation of additional drive systems. 

Our objective is therefore to combine the advantages of different press types and to 
enable adaptability without loss of productivity. A new approach is the independent 
actuation of the press ram at three points [16]. An independent motion of these 
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points allows any desired motion of the ram in three degrees of freedom (dof). While 
mechanical presses highly rely on a stiff design to achieve a high accuracy, a free 
3-dof ram motion allows for a compensation of mechanical inaccuracies, elasticities 
and disturbances by means of control systems [17]. Thus it is possible to break away 
from previous design constraints and to pursue new design objectives. 

Scheitza [45] proved the feasibility of these theoretic considerations of a new 
3D Servo Press concept with a mechanical demonstrator with | ton press force, 
Fig. 3.34. Each of the three ram points is driven by an independent press gear which 
consists of eccentric and modified knuckle joint kinematics. To adapt the shut height 
of the tools, two additional spindle kinematics modify the press gear. Several studies 
have shown that the new press concept allows to extend process limits and com- 
bine processes, thus increasing flexibility and productivity. The ability to react to 
disturbances paved the way to control product properties, see Sect. 5.3.2. 

After successful validation of the 3D Servo Press concept, it was scaled up from 
a prototype with 1 ton press force to a 160 ton press, as shown in Fig. 3.34. While 
the press force is upscaled by a factor of 160, geometrical dimensions are only 
upscaled by a factor of approximately 4. This leads to a number of challenging size 
effects. The rolling bearings used in the prototype reach a technical limit in terms 
of load capacity and dimension at this scale. Plain bearings normally used in press 
design are accompanied by bearing clearance, which adds up through the kinematic 
chain. Investigations on this scaling effect led to the development of novel combined 
roller and plain bearings, as described in Sect.5.4.2. With the integration of such a 
combined bearing design the bearing size has been reduced, while at the same time 
increasing the service life and stiffness of the bearing [47]. 

Scaling the ability to mount larger tools comes with a dimensional increase in the 
ram size. But to achieve the same tilting angle with the 1600 KN press, the ram drive 
points have to cover a larger distance, which is called the stroke height. Therefore, 
the stroke height had to be scaled up from 41 to 100 mm with an additional adaption 
of the shut height of 200 mm. Besides technical constraints and scalability laws, also 
requirements and restrictions by the infrastructure department had to be complied 
with when scaling up the press. Due to the associated maximum installation area and 
height, linear scaling of the press kinematics proved to be not practicable. In order to 
realise the three gears in the required dimensions, a new arrangement of individual 
levers was carried out, compare Fig. 3.34. The scaling of the stroke height results in 
a smaller width to height ratio. 

During the scaling of the gear dimensions the absolute manufacturing tolerances 
increase, adding up in the kinematic chain. These have a significant effect on the 
accuracy of the ram positioning and thereby on product quality [17]. Challenges are 
to produce individual parts of up to 2000 mm + 20 um in length with homogeneous 
material properties. 

Next to manufacturing individual parts, assembly and delivery bring up new scal- 
ing challenges. Due to infrastructural limitations, the press could not be fully assem- 
bled at the operating site. Developments of innovative products come with a signif- 
icant amount of uncertainty, especially with respect to functionality. This requires 
strategies to reduce both uncertainty and cost. Therefore, the press had to be assem- 
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Fig. 3.34 Kinematic comparison of 1 and 160 ton 3D Servo Press 


bled at an assembly location where also all functions had to be tested. To reach a cost 
minimum between transportation costs and assembly hours, the press was designed 
to be disassembled into two parts, transported to the operating site and reassembled 
with special equipment within a few hours. 

The electromechanical devices had to be scaled to drive the scaled gear mecha- 
nisms and provide the pressing force. Presses require high torques but typical elec- 
trical machines provide high velocities at low torque. The prototype was equipped 
with gearboxes to increase the torque transmission, but that comes with the disad- 
vantages of reduced efficiency, lower stiffness, large installation place, increased 
weight and maintenance. Hence, a gearbox cannot be upscaled for the 160 ton press; 
thus direct drive design is desired which requires high-torque drives. The diame- 
ter of high-torque drives is significantly larger than those of typical drives, as the 
torque in electrical machines scales linearly in stator length and quadratically in sta- 
tor diameter. To achieve a symmetric torque on the eccentric shaft, the 160 ton press 
was equipped with 2 torque drives on each eccentric axis, the shafts of which being 
positively coupled with the eccentric. 

Typical ram motions such as a press stroke or an orbital motion can be adopted 
from state of the art press control in which the drive motion defines the ram motion. 
But the 3D Servo Press is designed to control the actual product properties as 
described in Sect.5.3.2. Therefore it allows for arbitrary 3D motions of the ram, 
which requires a paradigm shift in the control. Control methods can be adopted from 
robot control in which the drives are controlled in a closed-loop process and the kine- 
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Fig. 3.35 Scaling of development method and design of the 3D Servo Press using the V-model 


matic is controlled in an open-loop by means of inverse kinematics [28]. First control 
approaches were investigated in simulations, being implemented and validated on 
the prototype. This method corresponds to the V-model shown in Fig. 3.35, based 
on feeding back experience in the validation phase to the design phase. As lack of 
knowledge plays a major role in innovative research projects, early validation phases 
are crucial to be able to adapt to new insights. By performing time-consuming design 
and validation steps on the prototype, these steps can be significantly reduced for the 
160t 3D Servo Press whereby commissioning time and risk can be cut. 

Early validation phases have shown that since the limited installation space did 
not allow a press design with maximum mechanical stiffness, the press elasticity has 
a greater effect on accuracy. Hence, the lower passive stiffness has to be increased by 
means of stiffness models and active measures, i.e. a closed-loop control of the kine- 
matics as described in Sect. 5.4.1. A closed-loop control of the kinematics requires 
real-time adaption of the drive motion and hence real-time solution of inverse kine- 
matics. As no explicit solution is available for the inverse spindle and ram kinematics, 
real-time optimisation routines were applied but are computationally expensive. But 
as higher control speed only comes with a higher sampling time [28], the optimisa- 
tion steps had to be parallelised with the control. Stability analyses were carried out 
in experiments on the prototype and have demonstrated the effect of uncertainty that 
inhibits industrial closed-loop ram control today. The early analyses on the prototype 
also allowed to develop new robust control methods shown in Sect. 6.1.7. 
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An important aspect of the motion control of a press is the measurement of the 
actual ram position in three degrees of freedom. While a tactile measurement of the 
ram would be most accurate, it has to be placed in the working area and therefore 
is less robust regarding potential damage, see Sect. 5.2.4. On the other hand, visual 
measurement methods must trade off between sampling rate and accuracy and are 
affected by oil mist, lighting conditions and others. To receive a robust but also accu- 
rate position [7], force and position sensors have been placed in the gear mechanism 
close to the ram to be combined with an observer model. 

An additional force measurement of ram forces pursues two tasks: (A) enable 
accurate force control and (B) protect the machine against overload. As direct force 
measurement in the force flow reaches technical limitations when scaling up, only 
indirect force measurement is applicable. This requires a structure with linear elastic 
behaviour and continuous cross-section. To reduce unwanted effects, the measure- 
ment should be close to the ram. The drive rods that connect gear and ram bearings 
are highly suitable for that task due to their ideal linearity. But due to its length and 
geometrical uncertainty, minor buckling is to be expected. Buckling distorts force- 
measurement if only measured on one face. Therefore three piezo force-sensors were 
installed on the drive bars. One way to compensate the buckling effect is to calculate 
the mean of the sensors via software. Another way is to use the piezo sensors as an 
electric circuit to calculate the mean. By connecting the piezo crystals in series their 
charge physically sums up; this performs the same function as the mean, however 
by even tripling the accuracy. 

Besides the control system, the majority of the software modules were likewise 
developed and validated on the basis of the prototype. This includes functions, such 
as the user interface, sensor evaluation, logic, motion control and real-time commu- 
nication. While a user-interface is run by an industrial PC communicating with a 
programmable logic controller (PLC) via non-real-time ethernet, a real-time com- 
munication between PLC, sensors and drives is mandatory. This involves also the 
synchronisation of the positively coupled torque drives. In contrast to the prototype, 
each shaft that drives an eccentric gear is equipped with two 3500 Nm torque drives. 
To add up the torques of both drives and prevent that both drives operate against each 
other, both drives synchronise their torque in a master-slave setup. While the mas- 
ter drive is controlled by the kinematic press controller, the second drive is directly 
linked to the measured torque of the master and thus supports its motion. 

As research tasks changing over time require modifiable software, safety func- 
tions must be outsourced to non-modifiable hardware. Hence, safety functions are 
performed by sensors and an additional safety PLC. Although the design of the 
functional safety of the 3D Servo Press for compliance with the Machinery Direc- 
tive 2006/42/EC [12] is based on typical presses, its machine safety has required 
several innovations. 

While the actual press force on one hand serves as a process and control variable, 
the force sensors also protect against overload. When the maximum force is reached 
in case of a fault, the machine motion is decelerated to zero. As three degrees of 
freedom are involved in the motion, a simply upward motion of the ram might damage 
the tool. The new closed-loop force control allows to safely move the ram up to a 
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limited force and stop once the tool is locked. In contrast to typical servo presses, 
the spindle kinematics of the 3D Servo Press is designed to continuously adapt the 
dead centres during the process. Due to the high kinetic energy in the spindles during 
the process, multiple adaptions of the initial prototype design have been performed. 
This involves a large amount of kinetic energy being converted into heat. Therefore, 
highly efficient spindles have been installed in the 3D Servo Press. However, the 
converted heat amount depends on the load and motion history, which is why both 
spindle nuts are additionally monitored with temperature sensors. The second spindle 
related safety aspect is maintaining the mechanical working area. On the one hand, 
the mechanical limitation of each individual spindle must be protected. In contrast to 
the prototype, the spindle force of the upscaled version is larger than the mechanical 
load capacity and therefore requires a sensor-based end stop. However, due to the 
high potential kinetic energy, it is impossible to ensure that the spindles decelerate in 
time when the end stop is reached. Therefore, a second sensor for speed reduction was 
integrated before the end stop. On the other hand, operating the window nonlinearly 
depends on both spindle positions. While the control software guarantees to keep 
these boundary conditions, an additional non-tactile sensor monitors compliance with 
the process window. To improve the control performance and accuracy, combined 
roller-plain bearings were integrated in each joint. Those are lubricated via multiple 
circuits which are being monitored in terms of flow, pressure and temperature. 

Due to its 8 servo drives, the 3D Servo Press requires a maximum electric power 
of 1.2 MW resulting in a nominal mechanical press force of 160 tons at a maximum 
speed of 100 strokes/min. While eccentric drives contribute to the maximum speed 
with 100kW each, the spindle drives come with 300kW. The spindle kinematics is 
designed for a high force transmission which allows to freely adapt the gear during 
the process without being disturbed by reacting forces. But the spindles are only 
allowed to move in a defined process window which yields in the achievable stroke 
and shut height. The process window of the spindle positions (Fig. 3.36a can also be 
mapped to the shut and stroke height, see Fig. 3.36b). This results in an shut height 
range from 500 to 700mm and a stroke height adjustment from 25 to 100mm, see 
Fig. 3.36b. 

The eccentric kinematics results in a position-dependent force transmission of 
the eccentric drives and therefore position-dependent maximum ram force. Under 
the assumption of an inelastic system, an infinite transmission ratio can be reached 
at the top and bottom dead centre. The nominal force of the 3D Servo Press is 
reached Qecc,i = +16° before the bottom dead centre. The maximum force reaches 
its minimum between the two dead centres. 

Due to the 120° arrangement of the three gears, which are coupled via the central 
spindles, the eccentrics can be controlled independently, as shown in Fig. 3.34. As a 
result, both a translatory stroke and an orbital motion, as well as anything in between 
can be realised. 

The maximum stroke height of 100 mm and the distance between the ram bearings 
result in a maximum pitch angle of 3.44° and maximum roll angle of 2.97°. 

Starting from an initial design of the | ton press in 2008, the 160 ton press was 
developed while starting the production of first parts in 2011, see Fig. 3.37. In the 
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Fig. 3.37 Timeline of development 3D Servo Press from 2008 to 2019 


following years, the press was further detailed as the production of individual parts 
progressed. In 2015, the first major milestone was reached with the assembly of the 
first gearbox. In the same year, the centrepiece of the 3D Servo Press was realised. 
The completion of the upper part began in 2017 and was completed with the assembly 
of the last gear box to form a fully integrated gearbox. Subsequently, the assembly of 
the lower part and cold commissioning of the press was carried out at the assembly 
site and assured the functionality of the 3D Servo Press. Following the cold commis- 
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sioning the press was transported to the operating site, where the final positioning 
and commissioning took place. 
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Abstract This chapter describes the various approaches to analyse, quantify and 
evaluate uncertainty along the phases of the product life cycle. It is based on the pre- 
vious chapters that introduce a consistent classification of uncertainty and a holistic 
approach to master the uncertainty of technical systems in mechanical engineering. 
Here, the following topics are presented: the identification of uncertainty by mod- 
elling technical processes, the detection and handling of data-induced conflicts, the 
analysis, quantification and evaluation of model uncertainty as well as the represen- 
tation and visualisation of uncertainty. The different approaches are discussed and 
demonstrated on exemplary technical systems. 


The book at hand is devoted to portraying our holistic approach to master the uncer- 
tainty of technical systems in mechanical engineering over all the phases of the prod- 
uct life cycle. The conceptual basis of our specific approach, as motivated in Chap. 1 
and elaborated in Chap. 3, as well as the consistent classification and definition of 
uncertainty in Chap. 2, form the foundation of this approach, see Fig. 1.12. 

This chapter deals with the analysis, quantification and evaluation of data and 
model uncertainty in mechanical engineering as an essential first step to master uncer- 
tainty. This will then be extended and completed by the methods and technologies to 
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master uncertainty presented in Chap. 5 and the strategies to master uncertainty intro- 
duced in Chap. 6. We provide both a mathematical and an engineering perspective 
to the analysis, quantification and evaluation of data and model uncertainty. Exam- 
ples of this interdisciplinary approach are among others presented in Sects. 4.3.1 and 
4.3.2. Furthermore, the methods are illustrated and their application is demonstrated 
using the technical systems presented in Sect. 3.6. The examples given appear in all 
phases of the product life cycle: design, production and usage, see Sect. 3.1 and, thus, 
offer a broad overview of the activities presented within this book. 

We start with the identification of uncertainty by modelling technical processes 
in Sect.4.1 with the aim to gain information on data uncertainty as introduced in 
Sect. 2.1; we consider uncertainty in single processes and its propagation in process 
chains. An important aspect in this domain is the detection and handling of data- 
induced conflicts and thus data uncertainty, which will be covered in Sect. 4.2; here 
the main goals are the prevention of critical failures, finding correlations among the 
data, and isolating faults. Computer models based on physical or empirical knowledge 
of a technical system are useful tools in the design phase. Since reality is commonly 
complex and cannot completely or exactly be represented by mathematical models, 
one faces the problem that all models are imperfect, i.e. model uncertainty occurs, see 
Sects. 1.3 and 2.2. In Sect.4.3, the analysis, quantification and evaluation of model 
uncertainty are being studied; here different methods to identify sources of model 
uncertainty and quantify model uncertainty are discussed with the aim to analyse the 
accuracy of a model belonging to a technical system. Finally, in the case uncertainty 
is detected, it is often unclear how to represent and visualise the information in an 
informative way. In Sect.4.4, a three-layer architecture is presented to solve this 
issue. 


4.1 Identification of Uncertainty During Modelling 
of Technical Processes 


Maximilian Schaeffner 


Uncertainty occurs if properties in the life cycle process product design, production 
and usage, as introduced in Sects. 1.2 and 3.1, cannot be determined completely or 
at all. However, these are no measurable characteristics of an individual product. 
Uncertainty becomes obvious in, e.g. deviations between the actual and the planned 
product geometry as a consequence of incompletely determined production processes 
or undesired behaviour during usage processes. This section covers the identifica- 
tion of data uncertainty during modelling of technical processes as a step towards 
mastering uncertainty. 

Besides model uncertainty, which has been introduced in Sect. 2.2 and is covered 
in this chapter in Sect. 4.3, possible uncertainty in the modelling of technical systems 
has to be considered during the product design as data uncertainty, see Sect.2.1, of 
the model parameters used for design and dimensioning. 
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In Sect. 4.1.1 we show how random deviations of the component properties can 
be taken into account probabilistically during system design for the example of 
passive and active vibration isolation. In Sect.4.1.2, we present the improvement of 
mathematical model predictions for the simulation of systems by means of a Bayesian 
inference based parameter calibration. 

Uncertainty propagates in process chains and can ultimately lead to undesirable 
behaviour in production or usage processes, see Sect. 3.2. Section 4.1.3 proceeds with 
the model-based description and analysis of uncertainty in consecutive machining 
processes, such as drilling and reaming or drilling and tapping. 


4.1.1 Analysis of Data Uncertainty Using the Example 
of Passive and Active Vibration Isolation 


Roland Platz and Jonathan Lenz 


The quantification and evaluation of uncertainty in load-bearing structures is of grow- 
ing importance for decision-making in the early product design phase as introduced in 
Sect. 1.2. This may especially become necessary due to the increasing complexity and 
scope of structures with multi-functional properties like mechatronic, semi-active or 
active systems. For example, active vibration control in mobile applications, such as 
an active suspension strut of a car, needs additional energy sources, sensors, actuators 
and a controller, see Sect. 3.4. This makes the active system more complex compared 
to a passive system with tailored, but only fixed inertia, damping and stiffness prop- 
erties [155]. In this section investigations to numerically compare the influence of 
aleatoric data uncertainty in the model parameters are summarised; according to 
Sect.2.1, this is on predicting the dynamic behaviour from a passive and an active 
technology for vibration isolation of a one mass oscillator [128-130]. The variation 
and uncertainty of model parameters of the passive system may lead to inadequate 
tuning. In addition and due to growing complexity of the active system, new uncer- 
tainty in the dynamic behaviour may arise compared to the passive system. Most 
importantly, the energetic effort and possible reduced availability of the active sys- 
tem may influence the acceptance of the active technology, see Sect. 1.6. Figure 4.la 
shows the simple mechanical model of a one mass oscillator with only four model 
parameters mass m, damping coefficient b and stiffness k for passive vibration iso- 
lation, as well as an additional gain factor g for active vibration isolation [130]. 

The mass m oscillates in z-direction when excited by the harmonic base point 
stroke w(t) = Wcos(Rr + ô) with the excitation frequency Q, excitation ampli- 
tude W, time 1, and phase shift 5. For simplification, 5 = 0 throughout the analysis. 
We assume linear characteristics of the internal damping force Fy, stiffness force Fx, 
and actuator force F, in Fig.4.1b. With2Dwo = b/m and os = k/m referring to the 
damping ratio D and the angular eigenfrequency wo as well as with the frequency 
relation n = R/wp and the factor ¢ = Q/(m w), the complex amplification function 
(CAF) of mass displacement in z-direction in the frequency domain is 
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Fig. 4.1 One mass oscillator 
with base excitation a simple 
mechanical model and b m 
internal forces [130] | en g 
Fy F F 
l w(t) 
` (a) (b) 
z 1+i2D 
(iS e (4.1) 
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with the amplitudes Z, and w from the complex particulate integral approach z ù t) = 
Zp $?! and w(t) = Wei”! as derived in [128]. The amplitude of (4.1) is 


u 1+ (2Dn) 
ie Ya PP + QDnt ety er 


and its phase is 


-2 Dn? -gt 
1-?+@Dm?+2Dngc 


y(n) = arctan (4.3) 


Deterministic case studies for different damping 


Figure 4.2 shows the amplitude (4.2) and phase (4.3) of the CAF (4.1) for different 
damping cases (a)-(f) depending on different damping coefficients b} < b2 < b3 and 
feedback gains g; < g2 < g3. 

For the passive system in Fig.4.2, cases (a)-(c), the mass m and stiffness k 
are assumed constant while three different damping coefficients b;_3 are chosen, 
with gain g = 0. The higher the damping, the lower the maximum amplitude Vmax 
at resonance frequency wo. However, the amplitudes beyond the isolation fre- 
quency Q > wiso remain higher with increased damping, which is well known. In 
case of active vibration isolation, cases (d)-(f), different gains g,_3 are chosen with 
assumed low passive damping bı. A higher gain leads to a lower maximum ampli- 
tude Vmax at resonance frequency wo and keeps a low amplitude beyond the isolation 
frequency 2 < @;so, Which is the benefit of the active approach. 
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Fig. 4.2 Amplitude |V (R)| and phase y(2) responses of the complex amplification function 
(CAF) (4.1) according to (4.2) and (4.3) for damping cases a—c with varying damping coeffi- 
cients by ( ), b2 ( ) and bg ( ) and without gain g = 0 for passive, and damping cases 
d-f with low damping coefficient b; and varying gains gı ( ), 22 ( ) and g3 (—-—) for active 
vibration isolation [128] 


Probabilistic case studies for different CAF-points-of-interest 


The influence of aleatoric data uncertainty on the numerical simulation of the dynamic 
behaviour of the passive and active one mass oscillator subject to vibration isola- 
tion is investigated with a Monte Carlo Simulation (MCS), see Sect.3.3. For that, 
additional CAF-point-of-interest case studies (i)-(vi) for the damping cases (a)-(f) 
are discussed: (i) varying maximum amplitude Vmax, (ii) varying vibration ampli- 
tudes |V „| at the undamped resonance frequency wo, (iii) varying isolation fre- 
quency wiso = V2 wo, (iv) varying amplitudes |V ı00| at the excitation frequency 
beyond the passive system’s fixed isolation frequency, 2 = 100 1/s > wiso, (V) vary- 
ing excitation frequency w,5 for — 15 dB isolation attenuation, and (vi) varying decay- 
ing time foo; until steady state vibration is reached or, respectively, initial transient 
vibrations are damped, so only 1% is left, see also [128]. The model parameters m, k, 
b,_3, and gı-3 in Table4.1 vary around an assumed nominal mean value, maximum 
and minimum values of the variations in % are considered as the +30 interval per 
model parameter according to experience and literature [120, 128, 142]. The MCS 
uses 10, 000 samples that meet the convergence criteria [101, 128]. 
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Table 4.1 Varying input parameter assumptions for MCS 
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Property Variable Nominal value Unit Variation (%) 
Mass m 1 kg +3 
Stiffness k 1000 N/m +10 
Damping bı 0.095 Ns/m 
Coefficient bo 9.487 Ns/m +30 
b3 18.974 Ns/m 
Gain 81 16 Ns/m 
22 25 Ns/m +15 
83 35 Ns/m 
0.45 0.45 
F 3 j 
gs cS 
2S Ta l 
X k 2 
>> Pa 
S 2 = Tg 
8 8 
0 i i 0 \ j A 
-22 Vio0,(a) -1 Vioo, (c) -10 70 %15,(a) 100 w15, (c) 140 


amplitude |Vıo0| in dB angular frequency wıs in 1/s 


(a) (b) 


Fig. 4.3 Histograms of the relative frequency Myp(x)/N for constant bin-width delta and varying 
amounts np = 1, ... Np of bins per output a x = V100, case study (iv), and b x = w15, case study 
(v), for damping cases ¢ and d for n = 1,..., 10, 000 samples [128] 


As an example, Fig.4.3 shows histograms of the relative frequency M„»(x)/N 
for varying number of bins N,, with n,=1,..., N, bins and with n =1,..., 
N = 10,000 samples, and constant bin-width A per varying output x = Vioo and 
x = @15 according to the CAF-point-of-interest case studies (iv) and (v) for damp- 
ing cases (c) and (d) [128]. 

In summary, Fig. 4.3a shows that for case (iv), the relative frequency M,,,(Vioo)/N 
of the amplitude Vioo becomes relatively less narrow around the empirical mean 
V 100.(0) = —12.66dB with a relatively small standard deviation syj00,(c) = 0.45 dB 
due to high damping b; for the passive approach, damping case (c). However, for 
the active approach, damping case (d), the standard deviation syıoo,ca = 0.33 dB 
and empirical mean V ıo0.« = —19.23 dB are smaller although the lowest gain gı 
is used. For case (v) in Fig.4.3b, the relative frequency M,,,(@15)/N of the angu- 
lar frequency w,5 at —15 dB vibration attenuation becomes relatively less narrow 
around the empirical mean @15 (c) = 122.82 1/s with relatively small standard devi- 
ation Sa15,(c) = 5.45 1/s at higher passive damping b3, damping case (c). Again, for 
damping case (d), the empirical mean @15 (c) = 80.48 1/s and the standard deviation 
S%15,(a) = 1.41 1/s are smaller than for the passive approach of damping case (c). 
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The observations described in this contribution show that if aleatoric data uncertainty 
occurs, high active damping results in less scatter at angular frequencies beyond the 
isolation point compared to the passive approach, see also [128]. Furthermore, the 
scatter of the amplitude attenuation beyond the angular isolation frequency is smaller 
with the active approach. Investigations are under way to validate the numerical com- 
parison of uncertainty in passive and active vibration isolation with an experimental 
example. 


4.1.2 Bayesian Inference Based Parameter Calibration 
for a Mathematical Model of a Load-Bearing Structure 


Christopher M. Gehb, Tobias Melz, and Roland Platz 


Load-bearing structures with kinematic functions such as the suspension of a vehicle 
and an aircraft landing gear enable and disable degrees of freedom and are part of 
many mechanical engineering applications. For an adequate numerical prediction 
of their load path, being e.g. necessary to develop a controller during the design 
phase, see Sect. 3.1, we need an adequate mathematical model with calibrated model 
parameters. Therefore, in this section, the adequacy of an exemplary load-bearing 
structure’s mathematical model is evaluated with its predictability being increased 
by model parameter uncertainty quantification and reduction, compare Sect.2.1. 
Conventionally, optimisation algorithms are used to calibrate the model parameters 
deterministically, as e.g. investigated in [51, 104, 161]. In contrast and as presented 
here, the model parameter calibration is formulated to achieve a statistically consis- 
tent model prediction with the data gained from experiments [87, 118, 144]. The 
most influential parameters being of interest for the model prediction, i.e. the load 
path through the load-bearing structure represented by the support reaction forces, 
are identified for calibration by a sensitivity analysis. Subsequently, the mathematical 
model is adjusted to the actual operating conditions of the experimental load-bearing 
structure via the model parameters by applying a Bayesian inference based calibra- 
tion procedure. Uncertainty represented by originally large model parameter ranges 
is reduced and quantified to increase the model prediction accuracy. 


Load-bearing structure 


The investigated load-bearing structure in Fig. 4.4 is derived from the more complex 
load-bearing system MAFDS intended to provide the possibility of intentionally 
introducing uncertainty in an exemplary technical system, see Sect. 3.6.1. 

The load-bearing structure consists of a translational moving mass ma connected 
to a rigid beam with mass mg and mass moment of inertia Og via a spring-damper 
with stiffness ks, a damping coefficient bs, as well as two semi-active guidance 
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Fig. 4.4 Exemplary load-bearing structure with semi-active guidance elements for load redistribu- 
tion, see Sect. 5.4.8, according to [52] 


elements. The two semi-active guidance elements provide an approach to redistribute 
loads, e.g. in case of weakened or damaged structural components, see Sect. 5.4.8. 
Two supports at the ends of the beam are equipped with an adjustable stiffness 
to simulate weakened or damaged structural components. A weakened or damaged 
structural component is represented by a reduced support stiffness depicting a reduced 
load-bearing capacity [53-55]. 


Mechanical and mathematical model 


Having in mind to achieve load redistribution, according to [52] the mathematical 
model of the load-bearing structure in Fig. 4.4 comprises parts to describe the gen- 
eral system dynamic, the friction and the electromagnetic actuator. The model part 
describing the general dynamic is chosen for model parameter calibration in this 
section. The friction model calibration is described in detail in [52, 56]. 

Figure 4.5 depicts the mechanical model and the free body diagram of the load- 
bearing structure. The mechanical model consists of a movable mass ma, a rigid 
beam with mass mp, length /g and mass moment of inertia ©g in the x-z-plane, 
see Fig.4.4. The associated independent degrees of freedom (DOF) are the vertical 
displacements z4, zg and rotation g [55]. The linear equation of motion system of 
the load-bearing structure becomes 


Mr+Dr+Kr=F (4.4) 


with the [3 x 3] mass M, damping D and stiffness K matrices, and the [3 x 


1] acceleration # = [Z,, Zp, GJ", velocity # = [Za, Zp, @]' and displacement r = 
[za, zB, o]! vectors. The [3 x 1] force vector F contains the excitation force Fox, 
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Fig. 4.5 Load-bearing structure, a mechanical model and b free body diagram with vertical forces, 
horizontal forces are neglected [52] 


the friction induced force F, and the forces Fse, and Fse r for load redistribution 
provided by the semi-active guidance elements, see Sect. 5.4.8. A more detailed 
derivation of (4.4) is presented in [52, 55]. 

The mathematical model of the load-bearing structure is derived to capture the 
load path through the structure and to predict and evaluate the load redistribution 
capability in case of the semi-active structure in [52, 55, 56]. The derived math- 
ematical model underlies model simplifications such as the assumption of lumped 
masses and rigid bodies. Furthermore, the spring-damper and the guidance elements 
are assumed to be free of mass, the model is assumed to be planar and undesired 
friction is summarised in a single dissipative force F, [52, 57]. Although these 
model simplifications can be attributed to model uncertainty, they may contribute to 
data uncertainty, as introduced in Sects.2.1 and 2.2, and can be—at least partly— 
considered via parameter calibration in the following. 


Sensitivity analysis 


The sensitivity of the mathematical model predictions on parameter variations is 
assessed by calculating the statistical significance of parameter variations on the 
model prediction variation. Thus, the influence of the model parameters with respect 
to a model prediction of interest is identified. We assess the statistical significance 
by an analysis of variance (ANOVA) using the coefficient of determination R? [9, 
136]. The coefficient of determination of model parameters 0 


E 
R? = (: Be ) - 100% (4.5) 
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calculates the proportion of the model output variability that can be ascribed to each 
calibration candidate parameter variation. The sum of squares total (SST) is the 
total model variability and the sum of squares error (SSE) is the unexplained model 
variability of the model parameters 0. More details regarding SST and SSE can be 
found in [9, 36, 52, 136]. The three model parameters 6 = [ma, bs, F] turned out to 
be the most influential ones in the scope of the presented example and, therefore, are 
selected to be calibrated. Model parameters which are not selected for calibration are 
assumed to be deterministic. Their values are chosen, e.g. based on measurements or 
manufacturer information. The detailed sensitivity analysis is presented in [52, 57]. 


Bayesian inference for model parameter calibration 


Bayesian inference is used as a statistical calibration approach to calibrate the uncer- 
tain model parameters identified as most influential on the model prediction of interest 
in the previous paragraph. The aim is to statistically correlate the model predictions 
with the measurements by solving an inverse problem [118]. The relation between 
measurements and simulations according to [75, 87, 144] is given by 


Yet) = YMG, 6) + ert), n=1,...,N (4.6) 


where Y(t) represents the experimental results and N is the number of measure- 
ments. The model prediction of interest YM(r, 0) is supplemented by the measure- 
ment error ¢,(t) ~ N(0, 07), that is assumed to be independent and identically 
distributed as well as normally distributed with zero mean and standard deviation 
o [144]. Through the Bayesian inference approach, we can update current knowl- 
edge of the system and its model parameters with new information obtained from 
experimental tests. Thus, the parameter uncertainty is quantified and reduced by 
systematic inference of the posterior distribution [87, 144]. Using the Bayes’ The- 
orem [13, 144], the posterior parameter distribution given the experimental results 
can be stated as 


L(Y®|0, YM) x P (0) 
P(YE) 


P(0, Y“ |Y®) = œ L(Y®|0, Y) x PO) (4.7) 


with the likelihood function L(YF|@, YM) representing the probability of experimen- 
tal results YF given a set of parameters 0 for the model prediction of interest YM [52, 
144]. The total probability P(YF) is typically not computable with reasonable effort 
and is only normalising the result anyway [65]. It is more practical to sample from 
a proportional relationship of the posterior parameter distribution. 

The parameter space is explored using the Marcov Chain Monte Carlo (MCMC) 
sampling to approximate the posterior parameter distributions P (0, YM|YF) by draw- 
ing multiple samples from these posterior parameter distributions. That is, the his- 
tograms of the model parameters 0 of all random samples produce the approxi- 
mated posterior parameter distributions P (0, YM|Y®) in (4.7) [117, 144]. Figure 4.6 
depicts the model parameter calibration results obtained from 25,000 MCMC 
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ing bs, the mass ma and the friction induced force F, according to [52]; x-axis limits represent the 
prior parameter ranges 


runs. The parameter distributions are depicted as histograms representing approx- 
imations of the posterior parameter distributions for the three model parameters 
0 = [mg, bs, F,,] [57]. Furthermore, the narrow histograms graphically depict the 
knowledge gain and the uncertainty reduction in the model parameter ranges. The 
model parameter ranges covering the 95% inter-percentile can be reduced by approx- 
imately 89% for the mass ma, by approximately 82% for the viscous damping bs 
and by approximately 84% for the dissipative force F, compared to the prior bounds 
represented by the limits of the x-axis in Fig. 4.6. 


Comparison of the non-calibrated and calibrated model predictions 


The effect of the statistical calibration procedure on the model prediction accuracy is 
exemplarily shown in Fig. 4.7 for a step load excitation Fex = 25 N. The envelopes of 
each of the 300 Monte Carlo (MC) simulation runs for non-calibrated and calibrated 
model parameter ranges are conducted and compared to the related support reaction 
force measurements Fy, and Fr averaged for 10 measurement repetitions. The support 
reaction force measurements Fy and Fp are quite similar as the load-bearing structure 
is undamaged. The non-calibrated model parameter ranges are equally distributed 
between the lower and upper prior bounds. The calibrated model parameter ranges 
are distributed according to the histograms in Fig. 4.6. 

The simulations using calibrated model parameters tend to be closer to the 
measurement with smaller envelopes. Even though calibrated and non-calibrated 
envelopes widely encompass the measurements, the envelope area of the calibrated 
MC simulations is reduced significantly by 75% compared to the envelope area of 
the non-calibrated MC simulations [57], qualifying the Baysian inference as suitable 
calibration method for the presented example. 
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4.1.3 Model-Based Analysis of Uncertainty in Chained 
Machining Processes 


Felix Geßner, Christian Bolling, Eberhard Abele, and Matthias Weigold 


In the production of components for technical systems, as described in Sect. 3.6, 
several processing steps are used. To generate the final product geometry, the pro- 
cesses are linked to a process chain, see Sect.3.2. A widely used process chain in 
machining is roughing and finishing. A process with a high material removal rate 
is linked to one or more processes capable of generating the required machining 
quality. The production of high-quality bore holes is often realised by the process 
chain drilling—reaming, as shown Fig.4.8. The reaming process slightly enlarges 
the diameter of a bore hole in order to improve the surface quality and the circularity. 
Another frequently applied process chain is drilling — tapping. The desired thread 
geometry is created by removing material from the pre-drilled bore wall. 
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Fig. 4.8 Process chains drilling—reaming and drilling—tapping 
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Fig. 4.9 Geometrical uncertainty in drilling-reaming and drilling-tapping process chains caused 
by a the pilot process, b the process chain or ce the final process 


Machining processes are generally affected by data uncertainty in form of incer- 
titude, see Sect.2.1.3. For this reason, functional parts of a component are always 
provided with interval-based tolerances, which ensure functionality in the overall 
system. Forms of geometrical uncertainty, which occur in drilling process chains, 
are shown in Fig.4.9. The occurring uncertainty can be categorised according to 
their origin. One source of uncertainty are geometric deviations of the pilot hole, 
e.g. variations in diameter, straightness or cylindrical shape. Those deviations can be 
caused e.g. by hardness deviations in the workpiece material. Another source is the 
process chain in which positioning variation between the pilot hole and the following 
process step occur. Since uncertainty is accumulated, deviations can also neutralise 
each other. The uncertainty must therefore be evaluated in the overall context. Axes 
misalignment of up to 0.03 mm occur due to limited accuracy of the machine tool 
and re-clamping operations. In industrial applications, e.g. reaming of valve guides 
in a cylinder head of a combustion engine, misalignments of up to 0.1mm occur, 
which are caused by the joining process of the blanks [72]. A radial deviation of the 
pre-drilled bores is induced due to oblique and uneven surfaces, incorrectly placed 
centring, cavities, transverse bores, blowholes and inclusions. The resulting radial 
forces lead to elastic bending of the pilot drill and thus to a slope bore [125]. 

Additionally, uncertainty is caused by the final processes without being influenced 
by pre-processing. A runout describes the radial displacement of the tool in the chuck. 
In industrial applications, a radial runout during reaming can be limited to 0.003 mm 
by adjustable adapters [72]. Earlier investigations on tapping indicate a radial runout 
of 0.03 mm [37]. During tapping, a synchronisation deviation between the translatory 
and the rotational axes often occurs. This is generated by a deviation between the 
axis movements when reversing the direction of rotation. 

Different approaches are used to model machining processes in order to predict 
process variables or raise process understanding. Zabel [166] differentiates models 
with regard to whether they are based on the finite element method (FEM) or not. In 
the simulation of machining processes, which are characterised by material deforma- 
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tion as well as occurring dissolution of the material bond, considerable computing 
time is required using FEM-based models. 

Non-FEM-based modelling requires more detailed knowledge of the particular 
process but is less demanding with regard to computational effort. This allows for the 
simulation of the effects of uncertainty in less time. Basically, these approaches are 
divided into analytical and geometrical models. Analytical models use closed math- 
ematical expressions to describe the considered phenomena [166]. Thus, models of 
chip formation, shear planes, temperature and process forces can be established. The 
geometric approaches determine the geometric quantities of machining processes, 
which are often used as input for analytical models. Mechanistic modelling repre- 
sents a combination of geometric and analytical models. It is fundamentally based 
on the assumption that process forces, occurring during the machining process, are 
proportional to the chip cross-section [85]. 

Examples of mechanistic models within the context of reaming operations and 
the disturbance variables occurring can be found in [21, 72]. For tapping, the first 
mechanistic model aiming towards the analysis of the process and the influence of 
uncertainty are developed by Dogra [37]. 

The basic structure of the mechanistic process model based on [85] is shown in 
Fig. 4.10. The main input of the model is the original workpiece contour. We use 
a chip cross-section model, as shown in [1], to determine the chip sizes, resulting 
from the tool geometry and position. The model is based on the intersection of 
2D elements. The process forces are determined based on these chip sizes in an 
empirical force model. Summation of the forces caused by each of the tool’s cutting 
edges enables calculating the resulting force that leads to a radial deflection of the 
tool. In the model, the deflection of the tool is e.g. calculated by a combination of 
dynamic and static modelling approaches [21]. When selecting suitable approaches, 
we consider the rotational speed of the tool and the prevailing geometric constraints. 
Due to the low rotational speeds in tapping, dynamic considerations can be largely 
neglected. However, the complex geometric boundary conditions must be mapped. 
Based on the tool’s radial deflection and its path, the tool position is determined. 
This information is used to specify the geometric intersection in the next calculation 
step. 
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Fig. 4.11 Mapping a positioning errors and b runout errors in the tapping model 


In linked machining processes, individual process steps are linked via the gener- 
ated geometry of the feature created in the previous step, e.g. the pilot hole geometry. 
This serves as the starting point for the subsequent machining process. For simul- 
taneous processes, however, successful model linkage requires further connection 
points, as each step’s stability may affect the others. For the combined machining of 
e.g. valve guide and valve seat, the process forces of each tool step are taken into 
account in an overall system. Here a Jeffcott rotor with several masses is loaded with 
the resulting forces of each individual tool step, so that the mutual influences can be 
mapped [21]. 

In the discussed mechanistic model approaches, we represent the geometry of the 
pilot hole by individual plane elements arranged in a star shape around the rotational 
axis of the model, see Fig.4.11. Therefore, each point on each of the planes has 
the same angle g when viewed in cylindrical coordinates. In order to implement 
for example geometric deviations, such as slope pre-drill bore and axial offset, we 
modify the individual plane elements. For this purpose, we vary the radius of the 
pilot hole as a function of the angle @ and the cutting depth z, as shown in Fig. 4.1 1a. 
A similar procedure can be used for the tool, since it is also mapped using plane 
elements. By shifting the radius of these elements depending on the angle, we can 
also map runout errors, see Fig. 4.1 1b. 

For mapping deviations in the synchronisation, or more general deviations in the 
tool path, we alter the displacement of the tool after each calculation step. In addition, 
we can model tooth chipping by altering the geometry or by completely removing 
a plane element of the tooth. Further disturbance variables can be implemented 
externally to the geometric intersection model. For example, hardness gradients in 
the component can be considered by manipulating the used force model. 

Our model approaches for tapping and reaming show that the axial offset between 
the pilot hole and the subsequent process step is the disturbance variable of greatest 
influence [72]. Due to the lack of radial guidance during tool immersion, radial forces 
can lead to tool misalignment and subsequently to tool inclination. As a result of the 
radial guidance of the tool after the immersion, its inclination over the drilling depth 
remains almost constant [2]. 
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Uncertainty is caused by several reasons and is an unavoidable part of any machin- 
ing process. Modelling approaches can describe and evaluate occurring uncertainty 
in chained machining processes. One approach is the mechanistic model approach, 
which is suitable to analyse the uncertainty in process chains like drilling—reaming 
and drilling—tapping. With the help of these models, we can raise the process under- 
standing and investigate an accumulation of uncertainty. Thus, we may derive recom- 
mendations for the design of the process chain and the individual processes contained 
therein. This finally facilitates the mastering of uncertainty in chained machining 
processes. 


4.2 Data-Induced Conflicts 
Florian Hoppe 


Active systems, as presented in Sects.3.4 and 5.4, have proven their effectiveness 
in mastering uncertainty. But in turn, they rely completely on the veracity of data. 
In many applications, the fusion of redundant data has therefore become common 
practice. However, if the confidence intervals of data from two or more sources do 
not overlap, this leads to so-called data-induced conflicts, which cannot be resolved 
with classical fusion techniques. Such data-induced conflicts reveal ignored model 
or data uncertainty, see Sect. 2.2. In the case of real-time controls, they require an 
instantaneous decision on which source to trust. Data-induced conflicts aid in uncer- 
tainty identification and are therefore a valuable tool in mastering uncertainty, see 
Sect. 3.3. 

In the past, unresolved and ignored data-induced conflicts led to several severe 
incidents. According to the European Space Agency (ESA), the crash of the ExoMars 
Schiaparelli probe on 14 March 2017 began when calculating the altitude from a 
saturated inertial measurement unit (IMU) signal, which resulted in a large negative 
altitude. A conflict with the radar Doppler altimeter unit was detected. Since no other 
verification methods had been implemented at that time, the true value could not be 
determined. Even though the conflicting IMU had been detected at that moment, 
this information was not passed to other subsystems and thus caused a chain of fatal 
decisions during the decent resulting in a crash at 150 m/s [152]. In the following 
two years the Boeing 737 MAX repeatedly encountered problems with the angle 
of attack (AoA) sensor. One of the malfunctions manifested in an ignored conflict 
between left and right sensor of 20° [151]. Hence, the control system anticipated a 
stall and automatically pushed the nose down, which caused the fully manned plane 
to crash. 

These incidents show that a general framework for verifying data as well as 
identifying and isolating a cause is required. Often a multitude of metadata, which 
include models, parameters and sensors, are involved in the generation of data. We 
refer to the general set of metadata as a data source. A data source consisting of 
a model and a sensor is also called a soft sensor, see Sect. 1.4. To master data- 
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induced conflicts, the metadata involved and their uncertainty have to be taken into 
account. For example, statistical dependency between the metadata of different data 
sources invalidates majority decisions used by voting algorithms. However, the use 
of systematic redundancy allows the identification of the cause of conflicts. 

In Sect. 4.2.1 we present and evaluate a method to establish systematic analytical 
redundancy and make it available for monitoring. Linking the metadata with the 
actual data allows us to link occurring conflicts with their cause. Two examples 
outline how to make use of physical models to infer specific causes in Sect. 4.2.2 and 
how to scale the method to systems where a multitude of conflicts might originate 
from a single fault Sect. 4.2.3. 


4.2.1 Dealing with Data-Induced Conflicts in Technical 
Systems 


Georg Staudter and Jakob Hartig 


In the product life cycle phases of production and usage of modern technical systems, 
see Sect.3.1, data is increasingly being generated redundantly. Redundancy is not 
necessarily physical redundancy of the sensor, but can also be established in the form 
of analytical redundancy, where measured values of the system are converted into 
the desired values via models. As introduced in Sect. 1.4, the combination of a sensor 
with a model to estimate target quantities using easily accessible auxiliary variables 
is called a soft sensor [48, 81]. An overview of the use of soft sensors can be found 
in a monograph by Fortuna et al. [48]. 

Redundancy increases the availability of information but may lead to contradictory 
statements and conflicts. These conflicts can be used to identify the uncertainty in 
the information about the system and, therefore, contribute to mastering uncertainty, 
see Sect. 3.3. 

This section introduces the concept of data-induced conflicts, discusses the advan- 
tages and challenges, and presents a method for dealing with data-induced conflicts 
in technical systems. The method is a slightly extended version of [70]. 


Data-induced conflicts 


Contradicting values of different redundant data sources are in conflict when their 
confidence intervals do not overlap. These so called data-induced conflicts can there- 
fore be attributed to the model, see Sect.2.2, to the parameters of the model, see 
Sect.2.1 and to sensor errors; also they are a symptom for lack of knowledge, see 
Sect. 1.4. If uncertainty is not sufficiently taken into account or if too few or uncertain 
data sources are considered, these conflicts remain unnoticed and thus unresolved. 
Figure 4.12 illustrates three redundant data sources for a target quantity with their 
respective uncertainty characterised by the confidence intervals and a data-induced 
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conflict between source A and the consensus of sources B and C. If two sources are 
in consensus, their confidence intervals overlap. 

Different methods have been developed to deal with conflicting data sources. On 
the one hand, conflicts between data sources can be seen as part of erroneous system 
behaviour. Thus, different methods use conflicting data for fault detection and fault 
isolation [76, 80]. On the other hand, conflicts can also be seen as part of the system’s 
normal behaviour. In that case, data from multiple sources can be used to reduce 
uncertainty and to improve the overall level of data quality. Simple methods for 
data reconciliation of conflicting sensor data are voters [46]. More elaborate fusion 
methods are the Bayes method [27, 97], the Dempster-Shafer method [89, 165], 
and heuristic methods [94, 149]. In the process industry, reconciliation methods 
are implemented for the estimation of process state data. The goal is to fuse the 
conflicting data, i.e. reconcile the state of the system with the conservation laws of 
mass and energy. For this, the conservation laws and the measured values have to 
be an over-determined equation system. With a quadratic minimisation method, the 
system states are changed until the values satisfy the conservation laws [76]. 


Method for dealing with data-induced conflicts 


The methods mentioned above for dealing with conflicting data sources fail to differ- 
entiate between sensor and model or do not take uncertainty into account. Therefore, 
we propose a methodology to support interpretation- and decision making processes 
in case of data-induced conflicts using the approach of redundancy via soft sensors. 
Through consideration of the relationships between sensor, models and information 
about the system, the cause of the data-induced conflicts can be isolated. For the 
proposed method, the following two points have to be addressed: 
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1. Conflicts emerge when the confidence intervals of redundant data sources do not 
overlap. Hence, the uncertainty in an interconnected system has to be propagated, 
see Sect.3.2. How can this be done efficiently in an environment with many 
sensors and models? 

2. The different data sources, i.e. soft sensors. How can the dependencies between 
different sensors and models be used in decision making processes? 


The proposed approach provides a methodology to identify lack of knowledge in the 
interpretation of conflicting sensor data by differentiating data sources into models 
and sensors and spanning the investigation from the redundant observation of a single 
value to the interconnection between models and sensors throughout the system, 
see Fig.4.13. Analytical redundancy via soft sensors is enforced by linking already 
existing, spatially distributed sensors with models to increase the availability of 
information about the desired values. 

Each redundant data source Q;, cf. Sect. 1.4, is associated with a given level of 
uncertainty due to precision and accuracy of the sensor, as well as model uncertainty, 
see Sect.2.2, which needs to be identified and propagated in the target quantity. 
The first step (i) is to examine that each data source Q; is within certain boundary 
conditions to ensure physical plausibility. Those limits need to be determined and 
individually based on the respective metadata, such as calibration data and known 
characteristics. 

On this basis, the redundant sources are compared among themselves to detect 
any possible conflicts in step (ii). In case of data-induced conflicts, a method for the 
compact visualisation of dependencies (iii) is provided to restrict whether the conflict 
is caused by a sensor or due to model uncertainty. In conclusion, the provided infor- 
mation supports the process of interpretation of sensor data (iv) and gives evidence 
in which sources to trust. In the following, each step of the systematic approach is 
presented in detail. 


(i) Plausibility. For checking the plausibility of data sources, sufficient metadata 
about the limit values derived from sensor characteristics, physical properties 
and technological limits are needed. With regard to the limits, there is a trade- 
off between sensitivity to erroneous behaviour and normal fluctuations [80]. 
In the case of a data source exceeding the prescribed boundary condition, 
the respective sensor or model can be excluded for further considerations in 
advance, and cross-checks with other redundant sources become unnecessary. 

(ii) Detection of Conflicts. Data-induced conflicts can be attributed to sensor errors 
(technical failure or application errors) or to model uncertainty. Model errors 
can be caused by either insufficient simplifications or changes of the underlying 
physical system, e.g. due to the wear, deformations, failure of components, see 
Sects. 2.2 and 4.2.2. For the detection of data-induced conflicts, the uncertainty 
of sensors has to be considered. Especially soft sensors may have several sensor 
inputs to calculate the target quantity. Therefore, the sensor uncertainty has to be 
propagated by the model. For the propagation of uncertainty, standard methods, 
e.g. [83] can be used. The technical implementation of error propagation and 
the necessary calculation of derivatives is done with automatic differentiation 
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(AD). In comparison to numerical methods AD has the benefit of calculating 
the exact derivative. In addition, data-driven models in the form of software 
code can be assigned a derivative with the help of AD [12, 109, 159]. 

(iii) Visualisation. Especially in the case of data-induced conflicts, knowledge about 
possible dependencies between data sources is important. Erroneous sensors 
or models and the consequences of the errors for other values have to be found. 
For downstream interpretation, it is important to depict the relationship between 
the soft sensors and their inputs in a human- and machine readable form. There- 
fore, a method for the visualisation of conflict scenarios has been developed 
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in order to clearly depict inter-dependencies between soft sensors (sensors and 
models) throughout the technical system, see Sect. 4.2.3. 

(iv) Interpretation. The interpretation of the visualised dependencies is done by 
reasoning. If a particular data source is only involved in other observations 
revealing no inconsistencies, the confidence in the respective sensor/model 
increases. If, on the other hand, a particular input is involved in one or many 
conflicting source values, it is suspected to be the cause of the conflict. For 
automation of the reasoning process, various classification methods can be 
used, e.g. pattern recognition, reasoning methods or neural networks [80]. Data 
sources deemed to be trustworthy can then be used in a fusion process with 
methods mentioned above. Data sources being suspected to cause the conflict 
are excluded. 


Our methodology (i)-(iv) reinforces redundancy and, therefore, data-induced con- 
flicts. Through the consideration of physical metadata and sensor data with their 
respective uncertainty, conflicts can be identified and the data quality increases. Fur- 
thermore, our method provides information about the relationships between sensors, 
models and the physical system to identify the cause of the conflict for human and 
machine interpretation. Section 4.2.3 shows the application of the outlined methodol- 
ogy on an experiment series conducted at the Modular Active Spring-Damper System 
introduced in Sect. 3.6 revealing data-induced conflicts. 


4.2.2 Data-Induced Conflicts for Wear Detection 
in Hydraulic Systems 


Jakob Hartig, Ingo Dietrich, and Peter F. Pelz 


Due to propagation and chain reactions of contamination [99], hydraulic systems 
are particularly sensitive to wear and contamination. Therefore, it is of interest to 
detect wear in early stages during the operation of a system in order to consequently 
avoid high cost due to unplanned maintenance. In the context of Sect. 4.2, this chapter 
serves to demonstrate the identification of ignorance, as introduced in Sect. 1.3, in the 
form of undetected wear by means of data-induced conflicts. As shown in Sect. 4.2.1, 
analytical redundancy can be used to learn about sensor or model errors by observing 
data-induced conflicts. 

Wear itself is not directly measurable during the operation but manifests itself 
in the changed system characteristics. Different methods exist to detect and isolate 
the changing system characteristics [76, 80]. In this section, we demonstrate the use 
of soft sensors to determine wear via data-induced conflicts between redundantly 
calculated flow rates as shown in [141]. For predictive maintenance, this approach is 
promising in terms of cost-efficiency, since existing sensors and models are used. The 
approach of this example is rather simple with only two data sources (soft sensors for 
pump and fluid system) for one calculated quantity (flow rate). A more complicated 
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Fig. 4.14 Fluid system with measured quantities (pressures p, temperatures T, rotational pump 
speed n) and soft sensors (Figure adapted from [71]) 


system can be found in Sect.4.2.3. In the following, first the two data sources are 
presented. Then wear detection via data-induced conflicts is discussed. 


Analytical redundancy by means of soft sensors 


To demonstrate analytical redundancy, the generic fluid system in Fig. 4.14, consist- 
ing of a positive displacement pump and a valve, is considered. The system acts 
as an abstraction for real fluid systems since the hydraulic resistance of a generic 
system is reduced to the hydraulic resistance of a valve. As indicated in Fig. 4.14, 
both components have an assigned soft sensor to determine the flow-rate that flows 
through the respective component. The purpose of both soft sensors for the pump and 
the valve, is to generate redundant data of the volume flow rate to make conclusions 
about the wear condition of the system. 

For the pump, an internal leakage model is used. The ideal flow rate Qp, deter- 
mined by the displacement volume V and the rotational speed n, is diminished by 
the internal leakage QO, 


Op =nV - OL (4.8) 


where the gap losses Q, are modelled with a semi-empirical dimensionless 
approach [140]. 

For the valve soft sensor, the definition of the K, value for valves is used as a 
model. The valves flow-rate Q, is given by 


APv@o 
Apo0 


O,(a) = Ky(@) (4.9) 
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Fig. 4.15 Characteristic curves for pump and valve with and without wear; the light grey area indi- 
cates possible operating states for worn components; the arrow indicates the data-induced conflict 
between the two models 


where Apo := 1 bar and ọọ := 1000 kg/m?. Ap, is the pressure difference over the 
valve and o is the fluid density. The K,-value is calibrated in dependence on the 
valve opening degree a. The uncertainty for both soft sensors is determined with 
error propagation. Both soft sensors depict an unworn state of the system. 


Identification of wear 


The fluid system in Fig.4.14 consisting of a positive displacement pump and a 
valve, can be described by the flow-rate-pressure characteristics in Fig.4.15. For 
the valve, the flow rate accelerates with increasing pressure, for the pump the flow 
rate decreases. The intersection of both curves is the operating point of the hydraulic 
system. Both pressure and flow rate have to be the same. When all components are 
new, both soft sensors are assumed to depict the relevant reality and therefore show 
the same flow-rate. 

Now imagine a worn valve. With wear, the cross-sectional area through which 
the flow passes, increases. At the same pressure level more fluid can pass the valve 
and consequently the operating point of the system changes. Since the soft sensors 
depict the unworn state, they do not recognise this change and consequently deliver 
contradictory flow rate measurements. For a worn pump similar considerations hold. 

The contradictory measurements are in conflict, if their uncertainty intervals do 
not overlap, see Sect.4.2.1. The conflict can arise due to sensor break down or 
model error. In both cases, the data-induced conflict represents ignorance. A sensor 
breakdown can normally be excluded with limit checking, as presented in Sect. 4.2.1. 
We therefore concentrate on model error or, in this case, component characteristic 
change. 

In order to review the presented soft sensor approach, the following two questions 
must be answered: 
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Fig. 4.16 Test-rig principle for simulating wear experimentally via bypass flows 


1. Is the influence of wear greater than the soft sensor uncertainty? 
2. Are two components sufficient to identify if wear occurs and where? 


To answer the first question, we carried out an experimental investigation of a worn 
valve [127]. The study revealed that the resulting flow rate changes from wear exceed 
the soft sensor uncertainty. This is a data-induced conflict indicating that wear occurs. 

With regard to the second question, we carried out measurements with a test 
rig [69, 71]. Wear changes the cross sectional area of the valve, and a worn positive 
displacement pump has larger gaps where fluid can flow back. Consequently, we 
were able to simulate wear on the test rig by installing bypass flows for the pump 
and the valve. This offers the benefit of easily changing wear conditions without 
actually destroying the components. The principle of the test rig used can be found 
in Fig. 4.16. The studies show that identification of wear is possible via data-induced 
conflicts when the flow rate outputs of the two soft sensors differ by about 6%. 

From the studies, it can be concluded that the localisation of wear is not possible 
with only two soft sensors. According to Fig.4.15, the possible operating range of 
the hydraulic system for various wear conditions is always below the characteristic 
curves with components in a new condition (light grey area). Therefore, the calculated 
volume flow rate of the valve soft sensor Q, is always lower or equal to the calculated 
volume flow of the pump Qp. This is independent from the wear condition of both 
components. For this reason, it is not possible to deduce the component subject to 
wear from these two calculated volume flows alone, the measuring system is under- 
determined. However, the history of the measurement data, additional information 
in the two soft sensors or additional soft sensors would make it possible to deduce 
the worn component. 

All in all, data-induced conflicts help in detecting ignored wear in hydraulic 
systems and can provide a measure for predictive maintenance. The localisation 
of the worn component is not possible with only two soft sensors. Additional system 
information in the form of additional soft sensors is needed for this purpose, see 
Sect. 4.2.3. 
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4.2.3 Fault Detection in a Structural System 
Tuğrul Öztürk, Daniel Martin, and Florian Hoppe 


Structural systems use mechanical elements to transfer forces along a path. The 
force transmission can be represented by mathematical models used to optimise 
the design, see Sect.6.1.1. A combination of such models with sensors allows to 
determine quantities, such as forces in spatially distant elements, and can therefore 
be used to estimate states that are infeasible to measure. 

Applications lie in the field of structural health monitoring of aeroplane to 
detect defects in fuselage panels [78], wing panels [167], and their connecting ele- 
ments [114]. The basis for those technologies are data obtained from integrated 
sensors and implemented models, which are assumed to be reliable. However, unre- 
liable data due to data uncertainty have led to numerous incidents in the past [79], 
as mentioned in Sect. 4.2. 

Today’s methods of online data validation are often based on the mere comparison 
of a few data sources. Information about the sensors and models involved as well as 
the results of these comparisons are not centrally fed back and forwarded to other 
subsystems. In the case of the ExoMars incident, faulty gyroscope data were detected 
in one subsystem but nevertheless reused at a later point in time [152]. 

Besides the mentioned applications, soft sensors also allow to generate redundant 
data throughout the system and to set up a sensor network. As a result, data sources 
can be continuously checked for being in conflict with each other. But when it comes 
to linking larger numbers of sensors and models, a single fault may cause numerous 
conflicts. To distinguish between possible faults, conflicts and their corresponding 
links in the network have to be visualised and analysed. 

Both, sensor data and models, forming the soft sensor, are afflicted with uncer- 
tainty. The uncertainty of sensor data expresses itself by an unknown distribution, 
which is considered by means of confidence intervals. Furthermore, the models used 
to describe the behaviour of mechanical components often contain many assump- 
tions and simplifications. Therefore, the uncertainty of a soft sensor can be classified 
as incertitude as described in Chap. 2. 

In the following, the method presented in Sect.4.2.1 is applied to a complex 
technical system, which is introduced briefly as a sensor network. We describe the 
subsequent steps of our method from conflict detection to visualisation regarding a 
real sensor fault case. As introduced in Sect.3.1, uncertainty occurs over different 
phases of the product life cycle. The presented and evaluated method is applicable in 
the system’s design phase to establish analytical redundancy as well as in the system’s 
usage phase by the visualisation of data-induced conflicts to master uncertainty. 


Scaling analytical redundancy to sensor networks 
The method presented in Sect. 4.2.1 allows us to analyse a large number of compara- 


tive quantities from analytically redundant data sources. These data sources consist of 
sensors only or of sensors linked with models, thus, soft sensors. Thereby, it is taken 
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into account that the involved data sources can be afflicted with data and model uncer- 
tainty, see Sects. 2.1 and 2.2. The method for dealing with data-induced conflicts is 
applied to the Modular Active Spring-Damper System (German acronym: MAFDS) 
presented in Sect. 3.6.1, which represents a multiple sensor-integrated structural sys- 
tem. The MAFDS consists of one upper and one lower truss structure, which are 
connected to each other via guidance elements and a spring-damper. The two truss 
structures in turn consist of individual beams, which are assembled to form tetra- 
hedral elements shown in Fig.4.17. Further, the MAFDS is equipped with several 
sensors, such as force transducers Fs; and Fp; as well as strain gauges in the upper, 
eV, and lower, ey truss structure. More details related to the integrated sensors in the 
MAEFDS are given in Sect.3.6.1. To establish analytical redundancy, the measured 
sensor data are converted by means of models to the desired redundant quantity, 
denoted here as comparative quantity. As mentioned above, a linkage of measured 
data obtained by an arbitrary sensor with an analytical model to gain an another 
arbitrary quantity represents a soft sensor. In case of the MAFDS, an example for 
such a soft sensor is the linkage of the beam strain gauge €}, in Fig.4.18a with a 
mechanical model m for the conversion of the measured beam strains to beam forces; 
here we assume a linear-elastic beam behaviour using Hooke’s law in Fig. 4.18b. The 
uncertainty of parameters involved as well as the measurement uncertainty have been 
taken into account to estimate the confidence interval. 

Based on the calculated beam forces, analytical redundancy can be established at 
the fixed support points, e.g. fixed support point 1 (FSP1) in Fig. 4.17. The forces 
measured by Fp; at FSP1 must be in equilibrium with the beam forces Fi, Fii, 
and Fıs, which are calculated via the beam strain gauges eV, e}; and &1, of the 
corresponding beams B1, B11 and B15, labelled in Fig.4.17. It should be noted 
that the beam forces are converted into the components of the global coordinate 
system, which corresponds to the coordinate system of the piezoelectric based force 
transducers Fp; at the three fixed support points. 


Interpretation of data-induced conflicts in sensor networks 


To investigate the method presented in Sect. 4.2.1, an erroneous data set of a drop 
test at the MAFDS is used. In this case, the triaxial force transducer Fp; at FSP1 was 
connected incorrectly so that the measuring channels for the y- and z-component of 
the measured forces were switched, thus, resulting in conflicts among multiple data 
sources Q;. In the first step, as shown in the proposed method according to Fig. 4.13, 
the plausibility of the sensor/transducer signals is verified by checking whether the 
measured data are within a reasonable range respecting the specific properties of 
the sensor, such as measuring ranges etc., as well as the structural system. After 
a successful plausibility check, the conflict detection for the data sources Q; is 
continued. 

Assuming the observed quantities to show a Gaussian normal distribution, the 
measured values are within a confidence interval around the mean value of all mea- 
surements with a certain probability. The uncertainty of sensors and, in this case, 
mechanical models is propagated throughout each data source Q; with Gaussian 
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Fig. 4.17 Sensors used in the MAFDS to gain analytical redundancy and labelled beams B1, B11 
and B15 for force equilibrium at fixed support point 1 with force transducer Fp; 


error propagation, which is implemented by using automatic differentiation, see 
Sect.4.2.1. The level of confidence is set to 95%. To determine data-induced con- 
flicts, the overlap of the confidence intervals of the data sources is regarded. It is 
defined in terms of the set [u — ko, u + ko] and the point where u is the expected 
value and o the standard deviation, while the coverage factor k determines the con- 
sidered amount of the probability space. If the confidence intervals match completely, 
there is no data-induced conflict and, in turn, an absolute data-induced conflict exists 
if the confidence intervals do not overlap. As a measure of the severity of a data- 
induced conflict between two data sources Q; and Q j, a discrepancy d;; is defined 
in the Eq. (4.10) 
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Fig. 4.18 a Example of a soft sensor used in the MAFDS, b mechanical model afflicted with 
uncertainty ô(-) for the conversion of beam strain ¢ to beam forces F, where E represents the 
modulus of elasticity and A the cross-sectional area of the beam 


Ki (tn) = Bj (tn) 


dij (th) = rer 
i j 


, with ui n) > Hilin). (4.10) 


The discrepancy d;; is calculated for every sample of the two data sources Q; and 
Qj at the equidistant discrete-time intervals t, = F> where f, is the sample rate of 
data acquisition. The redundant sources for the force equilibrium FE; of FSP1 are 
represented by Fig.4.19a-c, in which the force components in each direction are 
plotted over time. 

The plots in Fig.4.19d-f show the discrepancy between the two data sources 
over time for each force component. To define whether there is a conflict or not, 
we introduced a measure, denoted as degree of conflict (DOC), cij = dij(t), which 
is the time-averaged discrepancy over a time interval of interest [1o, t1], which has 
to be defined individually for each scenario. If the calculated DOC is greater than 
a predefined threshold value Cthresh, a data-induced conflict is detected. In this case, 
Cthresh has been set to 1.96, which is equal to the coverage factor k = 1.96 of a 95% 
confidence interval. That means that the time-averaged confidence intervals of the 
two data sources are exactly adjoining (m; — ko; = u; + kaj). 

For FE), a data-induced conflict emerges for the y- and z-direction. The result 
of the experiment shown in Fig. 4.19 is illustrated graphically by the conflict matrix 
shown in Fig. 4.20. The displayed vertical bars symbolise the different data sources 
0 for the mth comparative quantity based on different sensors and models, which 
are listed on the left side. Two or more data sources are used to determine one com- 
parative quantity, displayed on the bottom of Fig. 4.20. As described, these redundant 
values are examined for conflicts. Here, conflicts were detected in two of the evalu- 
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Fig. 4.19 Conflict detection for faulty force signal: a-c Triaxial comparison of force sensors with 
truss strain gauges taking the propagated measurement and data uncertainty into account, which is 
symbolised by the grey-shaded area, d-f resulting discrepancy between both data sources indicating 
a conflict 


ated comparative quantities: “support force 1’, which is based on the equilibrium of 
forces FE}, as described above, and ‘force symmetry’, which includes the condition 
that, in the case of a vertical impact, the forces in the support points 1-3 must act 
point-symmetrically around the centre axis due to geometric considerations. For the 
sake of simplicity, only sensors are shown in Fig. 4.20, but the described procedure 
can be extended analogously with the models contained in the applied soft sensors. 

For ‘support force 1’, the DOC c;; of the three data sources are illustrated in the 
conflict sub-matrix C“” above. Comparisons in this sub-matrix that exhibit a data- 
induced conflict are marked in black as the well as the bars that represent sources 
involved in a conflict and the comparative quantities estimated by this sources. Other 
comparative quantities, which contain the same sensors, are highlighted in grey. An 
important benefit of the shown representation is the marking of sensors that are 
involved in a conflict as potentially faulty, so that this information can be considered 
elsewhere, which in the case of ExoMars, as mentioned above, could have supported 
the identification of a faulty data source. 
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Fig. 4.20 Conflict matrix and resulting conflict rates due to sensor fault for multiple comparative 
quantities 


Sensor Fp; is the common component of both conflicting scenarios, thus it is 
obviously recommendable to check this sensor for a variety of sensor errors. To 
quantify this suspicion, a conflict rate Rc,n is introduced, which gives the operator of 
the system a hint on which sensor to check first. The Rc,, of sensor n is the number 
of conflicts in which the sensor is involved in relation to all comparisons of sensor n 
with other data sources. To illustrate that, it is shown exemplary for eV. This sensor is 
contained in one source for comparative quantity ‘contraction’, where it is compared 
with two other sources without a conflict and in one source for the comparative 
quantity ‘support force 1’ facing one other conflicting data source, so its conflict rate 
is 33%. If the measuring channels for the y- and z-component of the force transducer 
at support 1, as switched in the described case, were connected correctly, there would 
no longer be any conflict in the comparative quantities considered. 
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Conclusion 


Misinterpretations can occur during the processing of sensor data due to uncertainty, 
especially ignorance. Data-induced conflicts occur when physical quantities used for 
monitoring are recorded redundantly and contradict each other. These conflicts can 
be used specifically to detect faults. For this purpose, we developed a method which 
is based on differentiating data sources into models and sensors, linking them in such 
a way that relevant variables are consciously recorded redundantly. 

The proposed approach was applied to the MAFDS, the structural system pre- 
sented in Sect. 3.6.1. An information model was built that contains all relevant meta- 
data of the underlying sensor system, such as quantified uncertainty, as well as the 
used physical models. Automatic differentiation was implemented to propagate and 
determine the resulting uncertainty for conflict checking. 

While state-of-the-art fault-detection methods only take some redundant data into 
account, they lack the view on the whole system. A single fault may result in a 
multitude of conflicts, especially in time-variant processes. To assist an operator or 
developer in finding the fault, the amount of data from the conflict checks must be 
reduced and visualised in a way that makes it easier for humans to recognise a pattern. 
We presented a conflict interpretation method that furthermore takes the metadata 
into account. Hence, the method is scalable in both, the number of soft sensors and 
the model depth, for example to identify faulty model parameters. 


4.3 Analysis, Quantification and Evaluation of Model 
Uncertainty 


Christopher M. Gehb, Marc E. Pfetsch, and Stefan Ulbrich 


Trying to predict the future is deeply rooted in mankind. In almost every field of 
science and engineering, more or less sophisticated models are used to predict pro- 
cesses or properties and finally make decisions or draw conclusions [144]. Along 
these lines, models can be mathematical formulations, e.g. physical axioms and 
constitutive equations, or physical simplifications of reality, e.g. scaled prototypes. 
However, every prediction made by models comprises uncertainty, see Sect. 1.3. The 
uncertainty in model predictions arises essentially from the sources data uncertainty 
and model uncertainty, cf. Chap.2, supplemented by numerical errors in case of 
mathematical models [87]. This section focuses on the analysis, quantification and 
evaluation of model uncertainty. 

Reality is complex and cannot be completely represented by models, neither in 
mathematical formulations nor in prototype realisations, cf. Figure 1.5. Simplifica- 
tions, assumptions, conceptualisations, abstractions and approximations all result in 
model uncertainty [144]. No matter if underlying physics is only poorly understood 
or linearisations need to be used to reduce computational burdens: “Essentially, all 
models are wrong, but some are useful.” [23]. 
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With this in mind, model uncertainty needs to be taken into account for any 
kind of decision making and for the evaluation of model predictions in general. The 
ongoing trend towards digitalisation and the related substitution of real experiments 
by virtual testing or the combination to Hardware-in-the-Loop (HiL) tests emphasises 
the necessity of a detailed analysis of model uncertainty to get reliable predictions. 

This section is less understood as a textbook, but rather includes the consider- 
ation of model uncertainty for manifold examples and applications of mechanical 
load-bearing structures from both an engineering and a mathematical perspective. 
The section shows the importance of evaluating the model uncertainty in order to 
improve the models themselves and their predictions, and finally the conclusions to be 
drawn from the predictions. Additionally, mathematical approaches and algorithms 
are presented to analyse and quantify model uncertainty in theory and in practical 
examples of mechanical load-bearing structures. 


4.3.1 Detection of Model Uncertainty via Parameter 
Estimation and Optimum Experimental Design 


Alexander Matei, Marc E. Pfetsch, and Stefan Ulbrich 


In this subsection we develop an algorithm to detect model uncertainty using tools 
from parameter estimation, optimum experimental design and statistical hypothesis 
testing. The mathematical models which are investigated consist of functional rela- 
tions between input and output quantities, such as model parameters, state variables 
and boundary conditions, cf. Sect.2.2. Within a probabilistic frequentist framework, 
it is assumed that the true values of the model parameters can be estimated by 
repeated calibration and validation processes with new observational data. The latter 
are subject to noise, and as a consequence, uncertainty propagates to those parameter 
estimates. In an optimally designed experiment we then find the best choice among 
experimental setups, so that the extent of data uncertainty upon the model parameters 
which we quantify by confidence regions is minimised. If the mathematical model 
is correct then repeated model calibration and validation with different data sets 
obtained from optimal experimental setups should entail almost the same parameter 
values within a confidence region. We interpret inconsistencies in the parameter esti- 
mates obtained from different measurements as an indicator for model uncertainty, 
i.e. the mathematical model is incapable to explain all the data with the same set of 
model parameters. An important feature of our algorithm is that we neither assume 
any prior distribution nor a specific algebraic form of the model discrepancy term 
in the mathematical equations. Thus, we identify the source of model uncertainty as 
ignorance, see Sect.2.2. We first proposed our approach in [50]. 
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Mathematical setting 


Let u; € Uaa, j = 1,..., My be the inputs, such as boundary or initial conditions, 
p € Paa C R” be the model parameters, such as material constants, and y; € Y be 
the corresponding state variables. The first part of the mathematical model is given 
by an operator e : Y x Uaa X Paa > Y that defines the state equation 


e(yj, uj, p) = 0. 


We require that for every p € Paa and every u; € Usa there exists a unique solution 
yj; (uj, p) of the state equation. Furthermore, the solution operators 


Sj : Usa X Paa > (uj, p) > yj Uj, p) €Y (4.11) 


are demanded to be twice continuously differentiable in both arguments. 

In order to compare the state y; (uj, p) to experimental data it is necessary to map 
certain components to quantities that are actually measured. This mapping forms 
the second part of the mathematical model. Therefore, let us define an observation 
operator by 


h: Y x Pa a (yj, p) | hyj, p) Ee R”, 


where n, is the number of data collecting sensors. The experimental setup is charac- 
terised by these predefined sensor types or locations and the inputs u ;. We assume 
h to be twice continuously differentiable in both arguments as well. 

It is commonly observed that the acquisition of measurements z € R’™*"*"s is 
subject to uncertainty, where ny is the number of repeated measurement series. To 
this end, we assume a Gaussian noise profile that is added to the true but in general 
unknown value z* of the quantity of interest: 


zij =z} +e, e~ N(O, o°), (4.12) 


forall i = 1,...,my and j = 1, ..., nu where o? € R”*”s is the diagonal variance 
matrix of the employed sensors. Thus, we assume that the noise profile is indepen- 
dently distributed for each sensor. If the model is correct then it is a valid explanation 
of the data, i.e. 


zij = h(S;(uj, p*), p*) +8, (4.13) 


holds foralli = 1,...,nmandallj = 1, ...,, with the true but in general unknown 
parameter values p*. Now, the following questions arise: 


1. How can we estimate p* from z and quantify the uncertainty in the estimation? 
2. What are useful criteria to determine whether the Eq. (4.13) is incorrect? 
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The first question is extensively explored in the literature [10, 14, 92, 150] and we 
briefly introduce our method of choice below. The second question is strongly related 
to the detection and quantification of model uncertainty, cf. Sect. 2.2. This is still an 
active field of research. In the following we present our approach to detect model 
uncertainty as described in [50]. 


Parameter estimation 
For given measurements z the following nonlinear least-square problem with state 


equation constraints [19] is solved to obtain an estimate of the true values of the 
model parameters: 


; - Wk 2 
„in > 2 2 52 i — MO; PY] 
k=1 j=l i=l ~~ kk (4.14) 
st. p € Pa, e(y,u),p)=0, forj=1,...,m, 


where oh are the variances of the sensors introduced above and a, € {0, 1} are their 
weights, i.e. œ = 1 if, and only if, sensor k is used. We allow sensors to remain 
unused to save operational costs. Since the parameter estimate depends on the data z 
as well as on the weights w, which both remain fixed, we associate a solution operator 
(z, œw)  p(z, œw) with Problem (4.14). 

We choose n, = nsnunm as the new dimension to rewrite problem (4.14) in vec- 
tor form and further insert the solution operators S; of the state equation (4.11). 
Let ze R” be the data vector obtained from rearranging z and let h consist of 
h(S;(uj, p), p) for all j =1,..., my in a row and copied ny times. We define 
Stu, p) := S; (uj, P) j=1.....n, for brevity. Then 


r(z, p, S(u, p)) := Z — h(S(u, p), p) € R” (4.15) 


are the residuals in vector form. The diagonal weight matrix Q € R”*”2 consists of 
copies of wœ € IR”: and the diagonal variance matrix & € R”*" contains copies of 
o*. Then problem (4.14) can be rewritten into 


1 
min 51 p, Stu, p))' QU7'r(z, p, Stu, p)). (4.16) 


pe Paa 


Each locally optimal solution of (4.16) is arandom variable. In general, its probability 
distribution differs from the one of the measurements z. This is due to the fact that 
the mapping (z, œ) > p(z, œw) is nonlinear. The computation of confidence regions 
would lead to non-ellipsoidal sets which are difficult to handle. We therefore choose 
for a given confidence level 1 — a, where œ € (0, 1), a linear approximation of the 
confidence region K in the parameter space around E[p(z, w)] = p*, see [92]. In 
fact, we approximate the distribution of p(z, w) to be Gaussian with expected value 
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p* and covariance matrix C. Then the set X is ann,-dimensional ellipsoid determined 
by the covariance matrix C: 


K(p*, C, a) = [p e R"r :(p = i c'(p _ p*) < oa -@)] ’ 


where x2 is the quantile function of the x? probability distribution with np degrees 
of freedom. We consider the following approximations for the covariance matrix C 
coming from a Gauss—Newton approach [19, 38] and a sensitivity analysis [10, 38], 
respectively: 


Con=(F2D4F)", Cone ante, 


where J is the total derivative of the residual vector r with respect to the model 
parameters p and 


d'r; 
ii dp? 


H:= JTQETNI + YY nuE (4.17) 


i=1 


Our choice is determined depending on the application and the computational effort 
for the Hessian H, which requires the calculation of second order derivatives of the 
solution operator, compare Eq. (4.17) with Eq. (4.15). 


Optimal design of experiments 


In general, the goal in optimum experimental design is to minimise the confidence 
region of the parameter estimates by changing the experimental setup, namely, sensor 
locations and types represented by the variable w, boundary and initial conditions 
described by the inputs u;, etc. Since we employ a linear approximation of the 
confidence region the aim is to minimise the “size” of the covariance matrix C. 
There exists extensive research on different design criteria Y that measure the “size” 
of a matrix in the context of optimum experimental design [49, 143, 158]. We list a 
few prominent options: 


Wa(C) = trace (C), Wp(C) = det (C), We(C) = Amax (C). 


Depending on the application, the computational effort, and the adaptability of the 
experimental setup, we formulate slightly different optimisation problems. If the cal- 
culation of the Hessian A is fast, the number of sensors is small and the experimental 
setup is limited to adapting sensor positions only, we consider the matrix Cs from 
above in the optimisation model: 


min Y [Cs(@, pz, w), S(u, p, ®)))] 
s.t. w € {0,1", G(w) <0. 


(4.18) 
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Note that in an iterative solver scheme a new parameter value p(z, ) and new 
solutions S; (u, p(z, @)) to the state equation have to be computed after each step 
for all j = 1,..., nu. The inputs u; remain fixed here as the experimenter can only 
adjust sensor positions. Moreover, Cs depends on the measurements, and this would 
require new data, if any input values are changed. The constraints G(w) describe 
user-specific restrictions on sensor combinations and on the minimal number of used 
sensors, see [50, 92] for more details. Problem (4.18) is a non-convex mixed-integer 
nonlinear program. Since we assume the number of sensors to be small, we employ 
heuristic methods to solve it. 

If the computational effort for the Hessian H is large, the number of available 
sensors is high, and the experimental setup can be adapted in sensor positions and 
inputs, we use the covariance matrix arising from the Gauss—Newton approach in 
the following optimisation problem: 


min Y [Con(@, p, S(u, p))| + Bi R(u) + Bo Pe(o) 


W,U 


(4.19) 
s.t. œ € [0, 1], u € Ung, 


w,u 


where 1, 62 are positive constants. Note that the experimenter is now given the 


PIPN 


fixed in this setting. However, this approximation of the true covariance matrix may 
be less accurate than Cs where the parameter values are continually updated within 
the optimisation scheme. The function R(-) serves as a regulariser for the inputs to 
guarantee smoothness. For a fixed € € (0, 1] the penalty term P,(-) is chosen to be 
a smooth approximation of the £9 “norm”. We refer to [3] for a detailed mathemat- 
ical description. This penalty is intended to yield sparse and {0, 1}-valued optimal 
sensor weights. To achieve this, we proceed in the following way. Problem (4.19) 
is first solved with £; = | and we obtain optimal weights @,, and optimal inputs 


lowing optimisation problem with @,, as starting point and fixed inputs u: 


min Y[Con(@, p, SU, p))] + Bi RW) + BrP.) 


st. we [0, 1]. 


(4.20) 


By successively solving (4.20) with diminishing £; such that O < £; < £;—1 and with 
@¢,_, as Starting point, the optimal sensor weights tend to become sparse and {0, 1}- 
valued after a few iterations i = 1, 2,..., see [4]. 


Model uncertainty 
We now employ the two previously introduced methods, parameter estimation and 


optimum experimental design, to identify model uncertainty. Hereby, it is assumed 
that the model Mis valid in all sensor locations specified by a, for all inputs u; € Uaa 
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Input: Model M, test level TOL (e.g. 5 %}), nests, computational complexity and scope. 
Output: Should M be rejected? YES (1) or NO (0). 

01: Initialise i := 1. 

02: Generate initial data Zini in all feasible sensor locations. 

03: if computational complexity is small and scope is restricted to sensor positions then 


04: Solve (4.18) using Zini and obtain optimal w. 

05: Acquire data z within the optimised experimental setup @ for the inputs u;. 

06: else 

07: Calculate pini from (4.16) using Zini. Fix pini and solve (4.19). Obtain optimal @ and u. 
08: Acquire data z in optimal sensor locations w for inputs close to the optimum u. 

09: endif 


10: Check whether measurement errors are Gaussian. Otherwise go to line 05/08 or exit. 
11: Divide z into a calibration set z..ı and a validation set Zya). 

12: Calculate (peat, Ceal) using Za). Likewise, obtain Pya; using Zyal- 

13: Determine amin € (0, 1), such that py.ı lies on the boundary of K (Peal, Ccal, Qmin)- 
14: if amin > TOL/nesis then 


15: if i < Nests then 

16: i := i + 1. Goto line 11. 
17: else 

18: return 0. 

19: end if 

20: elseif amin < TOL/Megs then 
21: return 1. 

22: endif 


Fig. 4.21 Algorithm for the detection of model uncertainty (adapted from [50]) 


and for the same true model parameters p*. Since p* are in general unknown we state 
the hypothesis that a particular solution of (4.16) serves as a good approximation. 
Then repeated solutions of (4.16) for measurement series taken at different sensor 
locations with possibly differing inputs should lie in the confidence region of previ- 
ously estimated parameter values. But, if certain data sets lead to estimates that lie 
outside the confidence region of previous tests then the model is unable to predict 
the results of all experiments, i.e. the underlying model is inadequate. 

Figure 4.21 summarises our algorithm to detect whether a model M is inadequate. 
In line 02 initial (or artificial) data are introduced because they appear in the covari- 
ance matrix Cs in Problem (4.18). In the alternative way (line 07), it is necessary to 
compute an initial parameter estimate from this data before solving Problem (4.19). 

The acquisition of experimental data sets z in line 05 happens at the optimal 
sensor locations w for those inputs u; that entered the optimisation problem (4.18). 
Thus, the size of the predicted confidence region for the model parameters is at its 
minimum provided that the measurement error has the previously stated variance 
co, see Eq. (4.12). In line 08, experimental data is acquired at the optimal sensor 
locations but with inputs in the vicinity of the computed optimum u. By continuity 
of the objective function in Problem (4.19) with respect to the inputs, the size of the 
confidence region for the model parameters stays close to the minimal one. 
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A fundamental assumption of our methodology is that the measurement errors 
are Gaussian. To check whether the measurement errors are normally distributed 
(line 10) we refer to conventional techniques as described in [30], for example. 
We do not consider experiments that yield data with non-Gaussian noise since this 
violates our fundamental assumption in Eq. (4.12). 

The choice of the calibration and the validation set in line 11 is crucial. The model 
M may or may not pass the test depending on that choice. It is possible to divide 
the data set randomly as in a Monte Carlo cross-validation [39]. However, there 
are applications where an expert judgement is necessary to perform a meaningful 
division. Additional help to target the worst-case split can improve the performance of 
our algorithm. An example for this is given in Sect. 4.3.2 where we detect uncertainty 
in mathematical models of the 3D Servo Press. 

From lines 13 onward, a classical hypothesis test with Bonferroni correction [40] 
is performed. The null hypothesis and the alternative hypothesis are 


HYPo : p* = Pea are the true parameter values for all uj € Usa, 
HYP, : p* Æ Poa- 


Let TOL = TOL/MNtests be the corrected test level. The null hypothesis HYPo is 
rejected if pyar ¢ K (Peat, Coat, TOL). Recall 


K (Peat, Cea TOT) = | p € R” :(p — Pea)" Cal (P — Peat) < Xa, (1 — FOL)} 


Since we are usually performing more than one hypothesis test on similar data sets, 
we need to account for the problem of multiple testing. The Bonferroni correction 
of the test level, TOL = TOL/Megs, is a very conservative method to control the 
family-wise error rate (FWER), i.e. the probability of rejecting at least one true null 
hypothesis. It is reasonable to choose a small threshold for the FWER, e.g. 5% since 
it represents the error of the first kind which we want to be small when rejecting a 
model. The @min (line 13) is the p-value of the statistical test, which is the smallest 
test level under which the null hypothesis can only just be rejected. 

The greater the number of test scenarios Nests the easier it becomes for a null 
hypothesis to pass a particular test. Since we are interested in the overall null hypoth- 
esis that the true values p* of the parameters stay within the computed confidence 
regions, we interpret any rejected null hypothesis as significant, i.e. then the math- 
ematical model itself is subject to uncertainty. In practice, it may occur that an 
inadequate model passes quite a lot of tests. This behaviour can be explained by the 
fact that even an inaccurate model may provide satisfactory results on a particular 
range of inputs. However, provided that enough data are available one can identify 
ranges of inputs for which an inadequate model fails the hypothesis test. 

In summary, we proposed a new algorithm to detect model uncertainty and to 
quantify the quality of our decision when rejecting a mathematical model via error 
probabilities. We combined methods from parameter estimation, optimum experi- 
mental design and hypothesis testing to achieve this. Furthermore, our approach is 
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suited to identify particular ranges of inputs for which the model fails to explain 
the data. This is especially helpful when reconsidering the system design phase in 
product development, see Sect.3.1, to improve the models that have been used so 
far. 


4.3.2 Detection of Model Uncertainty in Mathematical 
Models of the 3D Servo Press 


Alexander Matei and Florian Hoppe 


The method proposed in Sect. 4.3.1 is demonstrated here using a component of the 
3D Servo Press, a multi-technology forming machine that combines spindles with 
multiple eccentric servo drives, see Sect.3.6.3. Forming machines have the task 
of performing accurate motions of the tool centre point (TCP) under high process 
forces. Besides control actions, this requires the acquisition of the TCP position, 
see Sect.5.4.1. Since direct measurements of the TCP are technically infeasible, 
elastic models shall provide the basis for the state estimation of the TCP [66]. To 
calibrate and validate the elastic models, measurements were taken on the small-scale 
prototype of the press. Furthermore, the costs for obtaining these measurements are 
reduced in view of future experiments on the full-scale 160t press. In this subsection, 
we briefly sketch mathematical models of the 3D Servo Press and present numerical 
results on the detection of model uncertainty from [50]. 

In order to model the elastic 3D Servo Press, components were classified according 
to their load scenario and their functional setting, respectively. The press mainly 
consists of coupling links and bearings, see Fig. 4.22. Additionally, friction between 
these components needs to be taken into account. In the following we describe the 
mathematical models that were employed for the different parts of the press and for 
the description of their behaviour: 


e A bar model is employed for those coupling links where the stress under load 
is very small. Each bar is discretised by the finite element method. Each finite 
element stands for two masses connected by a spring. However, the actual bar 
elements do not have a uniform cross-sectional area. To take this into account, a 
mass-spring model is derived from a finite element analysis [50]. 

e The remaining coupling links which experience bending moments are modelled as 
beams. Each beam is again discretised by the finite element method and reduced 
to a mass-spring model with lumped masses, i.e. all non-diagonal elements in 
the mass matrix are neglected. The governing equations come from the Euler- 
Bernoulli beam theory [58]. 

e Due to their progressive stiffness characteristics, all bearings are modelled as non- 
linear spring elements, located between the joints of the coupling links. 

e Asexpected, friction was observed in all bearings that move. Thus, the results of the 
experiments reveal a hysteresis behaviour in the load-displacement curve. Since the 
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Fig. 4.22 Linkage 
mechanism of the 3D Servo 
Press [50] 


complete physical modelling of friction is very challenging, we use application- 
specific substitute models and evaluate them experimentally. We propose three 
different models Mı, Mz and M; to deal with this phenomenon: 


M, : linear model where friction is neglected, 
Mo : discontinuous Coulomb’s friction model, 
Ms : continuous friction model with rate-independent memory. 


In order to validate each of these models, several experimental data sets were col- 
lected. The measurements were conducted with n, = 29 different process forces, 
which we call input variables. The first 15 forces were part of the loading and the 
last 14 were part of the unloading cycle. Our quantities of interest are the vertical 
displacements in point D, the horizontal displacements in point F, and vertical dis- 
placements in point Bo, when a vertical process load qp is applied to the press, see 
Fig. 4.22. 

There are n, = 3 sensors installed at these locations which measure the displace- 
ments. Each series of measurements was repeated ny = 6 times, although with 
slightly different process forces. To deal with this variability, we work with the 
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Table 4.2 Results for the optimum experimental design problem for model M3. A sensor combi- 
nation is defined by a three-digit number, where each digit stands for the usage (1) or non-usage 
(0) of the corresponding sensor [50] 


Sensor combination Wa(C) Wp(C) WE(C) 

111 (initial) 4.959 x 10° 1.168 x 10!6 4.956 x 10% 
101 1.118 x 102? 7.183 x 10° 1.118 x 102? 
O11 6.258 x 10% 1.484 x 1016 6.256 x 10% 
110 3.514 x10% 2.756 x 10!6 3.506 x 10% 


known setpoint values of the applied forces and linearly interpolate the data, see [50] 
for more details. We deviate from the algorithm presented in Sect.4.3.1 to some 
extent in that we do not distinguish between initial data and the actual acquisition of 
measurements. 

After the experimental data had been acquired and the measurement errors were 
checked to be Gaussian, our goal was to minimise costs to obtain these measure- 
ments by selecting only two out of the three sensors. The model parameters to be 
estimated are the stiffnesses of two bars, k7 and ks, see Fig.4.22. Since there are 
only two parameters to be estimated, it suffices to employ two sensors and repeat 
the measurement process. Table4.2 shows the results for the most important design 
criteria for the model M3, where we used the matrix Cs as covariance matrix, see 
Sect. 4.3.1. 

From Table 4.2 we infer that the absence of the second sensor entails an increase in 
all design criteria by a factor of ~107° compared to the initial value where all sensors 
are employed. This is a strong indication that the covariance matrix became singular, 
i.e. it is impossible to estimate the model parameters with that sensor choice. The 
absence of the first sensor, though, increases the maximal expansion, which is related 
to the design function Yg (C), and the volume, which is related to the design function 
Wp(C), of the confidence ellipsoid. However, the sensor combination displayed in 
the last row of Table 4.2, i.e. measuring the vertical displacements in point D and 
the horizontal displacements in point F only, leads to the smallest expansion of the 
confidence ellipsoid. We choose this sensor pair. Computations for the models Mı 
and M2 bring us to the same conclusion. 

As already mentioned, the experiments revealed a hysteresis behaviour. We want 
to apply the algorithm introduced in Sect.4.3.1 to see whether model uncertainty 
is recognised in the friction models Mı, Mz and M3. The output of these models 
together with the measurement data is shown in Fig. 4.23 for comparison. 

The continuous friction model is trained by an artificial neural network using real 
and simulated data [16, 112]. Hence, we used four of the six data series. Thus, only 
nm = 2 measurement series remained for the application of our algorithm. To stay 
fair, we used these two measurement series for all models alike during the validation 
which we perform by hypothesis testing. The splitting of the data set into a calibration 
and a validation set was done in four different ways, see [50]. First, we split the test 
set into loading z’ and unloading z”. For the loading case, we again split the data 
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Fig. 4.23 a repeated measurements of the force-displacement curve and b-d comparison of mea- 
surements (- - -) with the model output Mı, Ma and M3 (—), respectively [50] 


homogeneously into one calibration z} and one validation z? set. The same was done 
for the unloading case. Next, the loading scenario was tested against unloading, such 
that we split the data homogeneously into one calibration z!, and one validation z” 
set. Finally, data points from both loading and unloading were tested against each 
other, i.e. we had z?” for calibration and z! for validation. 

For each of these megs = 4 test scenarios we computed the amin, respectively, 
as shown in Table 4.3. Adopting the usual threshold TOL = 5% for the error of the 
first kind and applying the conservative Bonferroni correction with tests = 4, see 
Sect. 4.3.1, the corrected test level becomes TOL/“tests = 1.25%. Then, it is clear 
that model M; is rejected in all four test scenarios. As expected, the experimental 
data cannot be described by a linear model that neglects friction. A first attempt to 
model hysteresis which is caused by friction is given by M2. This model seems to be 
able to accurately model loading and unloading separately. However, it is insufficient 
in describing both phenomena with the same set of parameters. Our algorithm is able 
to detect this deficiency in the third and fourth test scenario. This result can be 
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Table 4.3 Test results for models M;, M2 and M3 [50] 


Calibration Validation Amin in % 


explained with the fact that the Coulomb model is discontinuous whereas friction 
is a continuous effect. The last column of Table 4.3 shows that M3, which has been 
trained by an artificial neural network, passes all tests successfully. Thus, this model 
is able to explain the present type of hysteresis with the same set of parameters which 
are valid within their confidence region. 

In conclusion, we have seen that the algorithm introduced in Sect. 4.3.1 performs 
well, if applied to the 3D Servo Press. The choice of the calibration and validation 
test sets has been done by expert judgement because of the special behaviour of 
the technical system, namely, the loading-unloading cycles. By splitting the data set 
this way, we directly target the worst-case test scenario, so that a Monte-Carlo-like 
splitting is not necessary. Since further development steps and online algorithms of 
machines rely on a valid model, a statement about model uncertainty is a valuable 
indication for the engineer. Furthermore, our hypothesis test could be used as a 
stopping criterion for the performance training of an artificial neural network. Besides 
the optimal placement of sensors for the model calibration, the presented method can 
also be used to identify uncertainty in different complex models, to be considered in 
the model selection. 


4.3.3 Assessment of Model Uncertainty for the Modular 
Active Spring-Damper System 


Robert Feldmann, Christopher M. Gehb, Maximilian Schaeffner, and Tobias Melz 


Research on methods to quantify model uncertainty in structural engineering has 
intensified more and more in recent years. The information gain of such methods 
typically relies on using experimental data, such as structural responses or vibration 
analysis. Examples for methods range from the well-known Bayes-factor [137] to 
methods based on the Bayesian inversion [60], an error-domain model falsification 
approach [122], or a technique using the adjustment factor method [124]. In Sect. 2.2 a 
comprehensive overview over methods for quantification of model uncertainty can be 
found. In this section, we introduce and compare two different methods to quantify 
model uncertainty by applying them exemplarily to the MAFDS, as presented in 
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Fig. 4.24 2 DOF model and Madd 
free body diagram of the Fe 


(b) 


Sect.3.6.1. First, a method based on the direct application of the Bayes’ theorem 
is presented and, subsequently, a method based on the modelling of a discrepancy 
function by means of a Gaussian process is shown. 

Figure 3.23 depicts the MAFDS and Fig. 4.24 the two degrees of freedom (2 DOF) 
model to capture its dynamic behaviour, where the drop height is denoted by h. The 
position of both the upper and lower mass is determined by the coordinates zu and zı 
of the 2 DOF model, where z; = zu — zı denotes their relative displacement. The 
equations of motion are 


My + Mada 0 Zu En b(z,) —b(z;) Zu 
0 m) \% -b(z.) b(z) ZI 


k(zr) —k(z:) Zu (mu + Madd) — 
z ea k(z:) + a (=) i ( mg ) = 9, 
(4.21) 


where k (zr) denotes the stiffness and b(z,) denotes the damping of the spring-damper 
system, as functions of the relative displacement z; and kef denote the stiffness of the 
elastic foot, as can be seen in Fig. 3.23. The structure is subject to gravitation g. For 
details on the derivation of the equations of motion see [107]. Regression studies on 
the stiffness and damping properties of the spring-damper system yielded several 
model candidates to describe the dynamic behaviour by combinations of linear, 
bilinear and power functions [105]. This leads to uncertainty regarding which model 
candidate is most adequate to predict the dynamic behaviour of the MAFDS. This 
model uncertainty is assessed and analysed subsequently by comparing the different 
model candidates in terms of model adequacy. The main content of this section is 
based on [45, 108]. 
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As outlined in Sect.3.6.1, the inputs to the system are the drop height h and 
the additional weight maqa that can be added to the frame. The system inputs are 
summarised in the input vector x = (h, Maga) . Exemplarily, the system outputs 
are the maximum relative compression Z;,max, the maximum force in the elastic 
foot Fef max and the maximum force on the spring-damper system Fa, max, as depicted 
in Fig. 4.24. The system outputs were chosen in such a way that they can be calculated 
by simulation of the model candidates, as well as measured experimentally, and 
thereby enable to compare different models. In Fig.3.24 in Sect. 3.6.1, the system 
outputs are shown as horizontal lines in the trajectories of the experimental drop 
test. For simplicity of notation, the scalar simulation model outputs n and the scalar 
experimental outputs y are condensed in the vectors 9, y, respectively: 


Zr,max,sim Zr,max,exp 
n= Fef max,sim Fy y= Fef ‚max,exp . (4.22) 
Fgd,max,sim Fsa,max,exp 


Application of Bayes’ theorem for quantification of model uncertainty 


In [108] we presented a method to compare different mathematical models based 
on the extent of agreement between simulation model output 7 and experimental 
output y. Model uncertainty was quantified for P = 4 selected mathematical models. 
In a Bayesian framework, the posterior probability gives a measure of how adequate 
a mathematical model represents the dynamic behaviour of the MAFDS. It estimates 
the probability of a simulation model output n of each model candidate with index q = 
1,..., Q under the condition that the experimental output y has been observed, for 
which measurement errors were not considered. Assuming an event-based Bayesian 
approach, H, denotes the statistical event describing the output of each model 
candidate q and A, is the statistical event associated with the observed experimental 
output y. Bayes’ theorem [13] is then written as 


P(Ay| Hyg) P(H,,g) 
P(Ay) 


P(H,,g|A,) = g=1,...,Q, (4.23) 


where P(H,,,) denotes the prior probability that the model H, , is the true model and 
is assumed equal for all Q = 4 model candidates: P(H,,,) = 1/4. The likelihood 
P(A,|H,,g) is the probability that experimental output y is observed when assuming 
a model q. Similar to a distance metric, it is estimated by the Cartesian vector distance 
d, of the simulation model and experimental outputs (4.22): 


dg 
P(Ay,| Hyg) = e (nr za), where dy = l|Ay, — Hyglla- (4.24) 


The total probability P(A,) serves as a normalisation constant and is determined 
analytically as the sum of the product of the likelihood P(A,|F,,,) and the prior 
probabilities P(H, 4) for all mathematical models q. Subsequently, the posterior 
probability (4.23) is calculated for K = 9 different, independent events. Here, an 
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event constitutes an experimental output y and simulation model output for the 
Q = 4 model candidates. For each k = 1,..., K event, the numerical values of 
the system inputs x, are unique as given in [108]. Figure 4.25 depicts the posterior 
probabilities P (H; %,4|Ay,x) for the four model candidates and the nine events. 
Models 3 and 4 exhibit a higher posterior probability for all K = 9 events than 
models | and 2, indicating that models 3 and 4 prove more adequate to predict 
the dynamic behaviour. In order to compare models over a multitude of events, the 
probability that one model holds true for all K = 9 events can be determined by 


K=9 


P(Hy glAy) = | | PU) cglAya) (4.25) 
k=1 


and is used as a measure of adequacy. For models | and 2, the overall posterior prob- 
ability amounts to 7.0- 1078 and 5.6- 1075. Models 3 and 4 exhibit significantly 
higher values of the posterior probability with 0.38 and 0.618, respectively. In con- 
clusion, model 4 is most adequate to represent the dynamic behaviour of MAFDS. 
In summary, the presented method provides a straightforward, computationally non- 
intensive way to quantify model uncertainty for comparing different models. 


A Gaussian process-based method for quantification of model uncertainty 


Now, we apply a different method as presented in [45] to quantify model uncertainty. 
It is assumed that all models are wrong and incorporate a model error due to missing 
or incomplete physics in the mathematical model [23]. Based on this assumption, 
the method builds upon the pioneering work of Kennedy and O’ Hagan [87], where a 
model discrepancy function is introduced to incorporate the model error; it thereby 
serves as a measure of adequacy of a mathematical model. In this framework, any 
experimental output of a system is represented as 


Yn = (Xn) + ô (Xn) + En, (4.26) 
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where y, € R, (n = 1,..., N) denotes the nth of a total of N measurements, 77 is 
the simulation model output (i.e. Fer,max» Fsd,max> Zr,max) With not necessarily unique 
inputs x, = [h, mada], ô is the discrepancy function and ¢, represents zero-mean 
normally distributed measurement noise for each measurement n. We model the dis- 
crepancy function 5(x) by a Gaussian process 6(X) ~ M (m (X), C(X, X )), where 


X represents an input matrix X = [x1,..., xy]. The mean function is denoted by 
m(X) and C(X, X) is the covariance matrix which is built up by the covariance 
function c(x;, xj) where x;, x; with i, j = 1,..., N denote the input vectors. The 


Gaussian process itself is fitted to the difference between measurement y, and the 
model output n(x,,), using the data set 


[ G1. 91 = ned), -+ (en, yw new); (4.27) 


For the Gaussian process, a constant mean scale m and a squared exponential covari- 
ance function c(x;, xj) are selected 


1 
m(X) = B, c(xi, xj) = of exp (36: —x;) M(x; - £) +078,;, (4.28) 


where 6;; denotes the Kronecker delta in this case. The matrix M is set to M = I e-? 
with identity matrix 7 € IR?*? and length scale £ > 0 [132]. The signal variance of > 
0 determines how much the discrepancy function values deviate from the mean value. 
Larger values of the signal variance oç lead to larger deviations of the discrepancy 
function. Measurement noise is accounted for by the noise level parameter o,, in the 
covariance function (4.28). It is assumed to be an additive, independent identically 
distributed Gaussian noise with variance oĉ [132]. 

The hyperparameters (£, £, or, on) inherent to the mean and covariance func- 
tion (4.28) essentially govern the behaviour of the Gaussian process and are deter- 
mined using a Bayesian optimisation scheme. Using the optimised set of hyperpa- 
rameters, the quantiles of the 95%-confidence interval for the discrepancy functions 
are specified analytically by 


C25 = É — 20f, Co75 = B+ 207. (4.29) 


Comparing the 95%-confidence interval of the discrepancy functions by their 2.5 and 
97.5% quantiles C> 5 and C97 5 yields a measure to select between competing models. 
The maximum absolute value of the two quantiles shows how much the discrepancy 
function deviates from zero and consequently indicates how adequate the model is. 

For the example at hand, the Gaussian processes describing the discrepancy func- 
tions ôg z,» Ôq, Fa and ôq, r,, are determined for the q = 1, ... , 4 model candidates (The 
model candidates are not identical with the ones investigated in the previous section). 
The 95%-confidence intervals of the discrepancy functions are shown in Fig. 4.26. 
All models overestimate the three outputs of the system, which can be seen by the fact 
that the absolute values of the 2.5 and 97.5% quantiles of the discrepancy functions 
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Fig. 4.26 The mean scale £ (shown as bars) and the 95%-confidence intervals bordered by its 
quantiles calculated by (4.29) for the discrepancy function 6 for the Q = 4 model candidates: a 
for relative displacement discrepancy function ôq,z, (Mill) b for force discrepancy functions ôq, Fep 
(E ) and ôg, Fy ( ) 


are consistently negative. For output Zr, max displayed in Fig. 4.26a, the 2.5% quantile 
for model 3 is closest to zero, indicating a higher adequacy of the model. However 
for the force outputs Fyqmax and Fer max Shown in Fig. 4.26b, the 2.5% quantile for 
model 1 is closest to zero, suggesting that model 1 is most adequate. In conclusion, 
no model consistently ranks best in terms of model adequacy. 


Conclusion 


Both presented methods provide a measure of adequacy that can be used to quantify 
model uncertainty. They essentially differ in their assumptions about model error. 
The method presented first does not differentiate between model error and measure- 
ment error. In consequence, the chosen likelihood function (4.24) does not reflect a 
distribution but is rather to be understood as a distance metric. In contrast, the Gaus- 
sian process based method assumes the model discrepancy as a Gaussian process 
and accounts for measurement error separately. 

Further, the discrepancy function provides valuable information about the differ- 
ence between model and measurement. For example, the mean scale exhibits if a 
model tends to under- or overestimate system quantities. In contrast, for the method 
based on the Bayes’ theorem, this information is lost due to the quadratic form of 
the likelihood function. 

For the modelling of an adequate discrepancy function, the Gaussian process based 
method essentially relies on assumptions on or a priori knowledge about suitable 
mean and covariance functions. As a priori knowledge is missing here, a rather 
simple choice for mean and covariance function was made. For the rare cases, in 
which there is a priori knowledge about the model discrepancy, the mean function 
could for example be polynomial, or consist of weighted basis functions. 
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As a concluding remark, the computing time for the first method is negligible, 
whereas it highly depends on the number of model inputs, outputs and measurements 
for the hyperparameter optimisation. 


4.3.4 Model Uncertainty in Hardware-in-the-loop Tests 
Manuel Rexer, Philipp Hedrich, and Peter F. Pelz 


Hardware-in-the-Loop (HiL) tests investigate the behaviour of real components con- 
nected to real time simulated systems [82, 98]. As depicted in Fig.3.20, HiL tests 
enable mastering uncertainty by a stepwise integration of a module into a real system 
by combining cyber world and real world. This section discusses the influence of the 
active interface between the two worlds. Therefore, compared to a simulation of the 
virtual component, HiL tests are in the virtual system. 

The first HiL tests were used in 1936 to simulate instruments in an aircraft cock- 
pit [82]. In the mid 1960s, electrical and hydraulic actuators were used to simulate 
cockpit movements [82]. Since the late 1960s, HiL tests have been used to simulate 
the response of structures and components to earthquakes [119]. Since the 1980s, 
HiL has been used at universities as well as in research and development departments 
for component validation [133, 139]. 

Formulated briefly, HiL tests are a symbiosis of an experiment and a simulation 
as Fig. 3.20 shows. This results in the following advantages compared to classical 
tests and pure simulation [82, 98, 139]: 


1. Real system components can be tested in the virtual system at an early design 
stage. This saves costs and development time. It is a prerequisite for the agile 
development of physical systems. 

2. Parameters of the virtual system can be changed with little effort to investigate 
different test configurations. 

3. Components with complex non-linear behaviour can be investigated in the sim- 
ulation as real components. The model uncertainty is reduced, since reality can 
be investigated. 


Therefore, HiL tests are ideal to examine components like the Active Air Spring with 
the associated parts we developed, cf. Sect. 3.6.2. Itis not necessary to have a two mass 
oscillator or a complete vehicle in hardware, since they can be virtually simulated 
to master the uncertainty of the component in an early design stage. HiL tests can 
therefore already be used in the design phase of the product life cycle introduced 
in Sect. 1.2. The disadvantages of HiL tests are a real time capable hardware being 
required with this hardware having an influence on the result; this is due to signal 
propagation times, measurement uncertainty, filtering, and the dynamics of the test 
rig, as shown in this subsection. In addition, an appropriate modelling is necessary, 
where a compromise between the required computing time and the complexity of 
the model has to be found. The relevant reality, cf. Sect. 1.3, is never represented 
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Fig. 4.27 Basic structure of the HiL experiments, consisting of simulation and hardware, as well 
as all signal flows [73] 


completely, so there is model uncertainty. In this subsection we therefore investigate 
the incertitude of model uncertainty and our approach in mastering this uncertainty. 

In our HiL tests, the Active Air Spring is coupled with the virtual quarter car, which 
is simulated in parallel in a real-time simulation environment. Figure 4.27 shows the 
principle structure and signal flows of these HiL tests. The air spring deflection Az 
calculated in the real-time simulation is transmitted to the uniaxial servo hydraulic 
test rig, the active interface, which deflects the Active Air Spring. The measured axial 
force F is fed back into the simulation. This is therefore a “closed loop simulation”. 
The simulated quarter car model—a foot point excited two mass oscillator—and the 
implemented controller are introduced in Sect. 3.6.2. The excitation is also used in 
the preview function of the implemented controller, which is equally integrated in 
the real time simulation. In order to minimise the influence of measurement noise, 
measured and fed back signals are filtered with a second order Butterworth filter with 
a cut-off frequency of 170 Hz (ZQC in Fig. 4.27). A more detailed investigation in 
the results of the HiL experiments can be found at Hedrich [73]. 

The performance indicators that are examined with these HiL tests are driving 
safety, e.g. wheel load fluctuation of,, and driving comfort, e.g. variation of body 
acceleration o;,, being obtained from real time simulation. 

The conflict diagram, Fig. 4.28, displays the measurement result of a HiL test driv- 
ing on a highway with 100 km/h marked by the diamond. To this end the standard 
deviations of the wheel load Fw and the body acceleration zZ, are determined by the 
time signals measured for T = 20s. Figure 4.28 shows the measured points for the 
designed controller with preview. The simulated result (square) is determined with a 
linear Active Air Spring model and the quarter car model from Sect. 3.6.2. The active 
Pareto line represents an ideal active system where the controller parameters have 
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Fig. 4.28 Conflict diagram with the results for driving safety op, and driving comfort o;, for the 
HiL tests (diamond) and the basic simulations (square), as well as the simulated active Pareto line 
as reference driving on a highway at 100 km/h [73] 
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Fig. 4.29 Adapted simulation structure. By taking into account the transfer functions of the hard- 
ware, the influence of these functions can be considered in the simulations [73] 


been optimised. The HiL influence appears in a deviation of the experiment from sim- 
ulation in driving safety by 11%. The influence on driving comfort is negligible. Our 
investigations and results from literature [26] with similar HiL tests show that the test 
rig in particular has a mayor influence on the results of the HiL tests. The dynamics 
of the test rig and the sensors have not yet been taken into account in the simulation, 
since this has never been necessary at any open loop component measurement. Fol- 
lowing the principle of simplicity from Heinrich Hertz introduced in Sect. 1.3, the 
transfer functions Gp = Gsen,z = Gsen, = 1 were assumed (cf. Fig.4.29, square). 
The model used for the hardware therefore does not take the reality sufficiently into 
account. 
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Fig. 4.30 Conflict diagram with the results for driving safety op, and driving comfort o;, for 
the HiL tests (diamond) and the basic (square) and adapted (triangle) simulations, as well as the 
simulated active Pareto line as reference driving on a highway at 100 km/h [73] 


To consider the influence of the HiL test rig on the calculations, we modelled 
the hardware as shown on the right in Fig. 4.29. The transfer function Gp is used to 
model the behaviour of the test rig. The transfer functions of the position sensor and 
the force sensor are also included via Gsen,z and Gsen,F respectively. Experiments 
carried out with the sampling time of 1 ms have shown that (1) the transfer behaviour 
of the position-controlled servo-hydraulic test rig up to 25 Hz can be approximately 
described by a dead time of 10 ms [100, 102] and that (ii) the influence of the sensor 
system in this frequency range can be neglected compared to the dead time of the 
testing machine. These results are consistent with results from literature [11]. A Padé 
approximation G, with a dead time of 10 ms of the third order is used to represent 
the dead time of the test rig in the hardware model [102]. 

Figure 4.30 shows all results in the conflict diagram. The deviation of the HiL 
test from the adapted simulation (triangle) in driving safety comes down to 2%. 
The following conclusions can be drawn: (i) The influence of the active interface 
is recognisable and it influences the results. (ii) If the influence of the test rig is 
considered in the calculation via a dead time element, measurement and simulation 
correspond quantitatively well. (iii) The remaining deviation is acceptable in the 
context of the linearised models used and measurement uncertainty. 

The model uncertainty, i.e. the neglect of the influence of the active interface, can 
thus be mastered by taking the transfer function of the test rig into account. Since the 
influence on the driving comfort, which is the main focus of the tests, is small, the 
HiL influence on the experiments is tolerated. In the future we will investigate the 
Active Air Spring integrated in the MAFDS with foot point excitation. This enables 
validations of the HiL tests and the simulation of the virtual component in the virtual 
system with a real component in the real system. 
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4.3.5 Identification of Model Uncertainty in the Development 
of Adsorption Based Hydraulic Accumulators 


Jakob Hartig and Peter F. Pelz 


When starting a product development from scratch, not much is known about the 
intended system. There is general physical knowledge and experience in the form 
of physical axioms and constitutive equations (cf. Sect. 1.3). However, ignorance in 
these early stages of product development can lead to a significant model uncertainty 
(see Fig. 1.5 in Sect. 1.3). 

In this section, we demonstrate this point in the development of innovative 
hydraulic accumulators. To ensure consistency with general knowledge we used 
axiomatic models to determine the potential of hydraulic accumulators filled with 
adsorptive material. In the following, we show that the omission of some of the sys- 
tem’s numerous interconnected physical effects can lead to a large model uncertainty. 

Hydraulic accumulators are used to store energy in hydraulic systems, e.g. for 
dynamic energy demand. The storage medium is compressed gas. Especially in 
mobile applications space and weight reduction by smaller and lighter components 
is very important. Thus the quality measured in acceptance and effort is increased, 
cf. 1.9. However, with hydraulic accumulators there are two opposing dependencies: 


(i) The energy density of hydraulic accumulators depends on the excitation fre- 
quency due to heat transfer processes. At low frequencies hydraulic accumu- 
lators are isothermal, whereas at large frequencies the state change is adia- 
batic. The transition frequency between isothermal and adiabatic behaviour is 
inversely proportional to the accumulator volume (to be more precise, it is pro- 
portional to the specific surface) and therefore, large volume and isothermal 
behaviour are mutually exclusive. 

(ii) The energy content of the hydraulic accumulators depends on the volume of the 
accumulator and thus on the size [93, 131]. Hence, energy density and energy 
content of conventional hydraulic accumulators cannot be maximised at the 
same time. 


To overcome this limitation, different physical effects can be considered. One of these 
effects is adsorption, i.e. adherence of gas molecules to the surface of a porous mate- 
rial (adsorbent) which was proposed in [126, 131]. The idea behind filling hydraulic 
accumulators with adsorbent material like activated charcoal, is that adsorption will 
act as an additional gas storage capacity. In addition to that, gas molecules inter- 
act with the adsorbent and therefore lose a translatory degree of freedom during 
adsorption. Kinetic energy of adsorbed molecules is consequently lower than of free 
molecules, and energy in the form of heat has to be released during adsorption (heat 
of adsorption Ea). Adsorption is consequently a heat source [113]. The interde- 
pendence of these effects make it necessary to evaluate the usability of adsorption 
in reducing the size of hydraulic accumulators via suitable models. In the follow- 
ing, we show some challenges of adequately modelling hydraulic accumulators with 
adsorption and the potential huge impact of model uncertainty on the outcome. 
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Fig. 4.31 Relationship between pressure and volume. Shaded area is the work for volume change 
performed on a gas volume 


The increase of energy density in hydraulic accumulators is equivalent to stiff- 
ness reduction. Figure 4.31 illustrates this connection. The work for volume change 
performed on a gas volume corresponds to the shaded areas in Fig. 4.31. The work 
for the volume change performed is limited by the upper working pressure pı based 
on the mean working pressure po. A lower stiffness of the hydraulic accumulator 
is reflected by a lower gradient in the p-V diagram. With the same upper working 
pressure pı, a lower stiffness leads to a higher compression from the average working 
volume Vo to V; instead of V/. Thereby more volume change work can be carried 
out and thus more energy can be stored. 

The intended function of adsorbent material for reducing the stiffness was origi- 
nally thought to be the additional gas storage capacity. With this in mind an analysis 
of a simple model was done in the two publications [126, 131]. For completeness 
the model from the two publications and some results are presented below. 

In comparison to the frequencies found in the application of hydraulic accumula- 
tors, the typical inherent time for adsorption is much smaller. Consequently, adsorp- 
tion was modelled as an equilibrium process. The number of adsorbed molecules q 
in mol depends on the pressure p in the accumulator and the mass of adsorbent maas- 
For small deviations from equilibrium conditions, the linear Henry approximation 
with Henry constant H is valid 


q = Mags Hp. (4.30) 


For the gas we assume the ideal behaviour 
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p=oRT (4.31) 
to hold, where ọ is the gas density, R is the specific gas constant and T is the abso- 


lute temperature. The equations of mass and energy conservation for the hydraulic 
accumulator result in 


dV _ do dq 
ve-_-n, 4.32 
Cu a dr Mee) 
Vg | ogee eer (4.33) 
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where V is the volume of the accumulator, M is the molar mass of the gas, c, and cp 
are the specific heat capacities of the gas. The heat transfer to the surrounding gas 
with temperature 7,, is modelled with the heat transfer coefficient œ and surface area 
of heat transfer A. All parameters for the hydraulic accumulator (Vo, po, a, Ta, A, V) 
were chosen to represent typical accumulators found in literature [93]. All adsorption 
parameters, namely isosteric heat of adsorption E'4 and Henry-coefficient H were 
estimated for nitrogen as described in [111]. 
In our case the accumulator volume V is changed dynamically, denoted by 


V=V+VsinQ2zft), (4.34) 


where the index 0 denotes the pre-charged average working state of the accumulator. 
Both energy density and energy content depend on the change of the pressure p 
with changing volume V, i.e. the stiffness 


nn (4.35) 


and for comparison purposes are de-dimensioned with 


V, 
Krak. (4.36) 
Po 


For dynamic applications the stiffness of the accumulator as a function of loading 
frequency 2 = 2x f is of interest. Therefore, the frequency response of the stiffness 
is shown in Fig. 4.32 (white-filled circles). Comparing the frequency response to the 
response of a model without adsorption (light grey curve), a stiffness reduction in 
the isothermal range, and a stiffness increase in the adiabatic range are visible [126, 
131]. 

Measurements on a similar system however, showed a stiffness reduction in the 
whole frequency range [29]. This deviation from reality is a sign of model uncer- 
tainty (cf. Sect. 2.2. Consequently, the assumptions for the model were revisited and 
the assumption of temperature independence of the adsorption was given up. In the 
updated model, the number of adsorbed moles is a function of pressure and temper- 
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Fig. 4.32 Comparison of stiffness for model q = q(p) according to 1st hypothesis as published 
in [126, 131], model according to 2nd hypothesis q = q(p, T) and reference accumulator model 
without adsorption g = 0 


ature. For the temperature dependency of the Henry coefficient H(T) the following 
exponential Arrhenius relation can be assumed [113] 


H(T) = Ho exp (a) . (4.37) 


The resulting stiffness from numerical simulation of the full nonlinear equations can 
be seen in Fig. 4.32 (black dots). It shows a stiffness reduction in the whole frequency 
range. 

To find the reason for the stiffness reduction, a parameter variation of the linearised 
new model in the adiabatic range was carried out. The parameter variation of the new 
model for the parameters Ho and E, in the adiabatic frequency range (cf. Fig. 4.33) 
shows that the stiffness in the adiabatic range is mainly influenced by Ey. This 
indicates that the magnitude of the adsorption enthalpy is more significant for stiffness 
reduction than the process of adsorption itself. 

To examine this issue further, a sensitivity analysis of the adsorption equilibrium 
was carried out. The results show that the sensitivity of the equilibrium loading with 
respect to temperature T is greater than on pressure, i.e. 


in 
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Fig. 4.33 Isolines of dimensionless stiffness K* in the adiabatic range for variation of Ho and 
|E|. A stiffness decrease can only be seen for values of | E A| being larger than about 9 - 10° J/mol. 
In this parameter range the size of the Henry coefficient Hp has little influence on the stiffness 


Due to ðq /ƏT being larger than ðq /dp, the number of adsorbed molecules decreases 
when compressing. Therefore, both results suggest that the stiffness reduction in the 
adiabatic range is reduced by a lower increase of temperature due to E, being 
drawn from gas for desorption. The pressure and temperature rise of compression 
are diminished due to the heat E4 being released in the adsorption. In other words: 
In contrast to the original assumptions, the adsorptive material is an additional mass 
source and a heat sink instead of being a mass sink and heat source. 

This is a totally different effect than originally intended, and therefore demon- 
strates a large model uncertainty due to omission of relevant effects. The discovery 
of this unexpected behaviour was only possible by comparing results from related 
areas with the model in early stages of the product development process. Inspired 
by these results, the model uncertainty, i.e. relevant but ignored reality was identi- 
fied (cf. Sect. 1.3). It emphasises the large effect model uncertainty can have on the 
results, especially in systems with interdependent physical effects. 


4.3.6 Uncertainty Scaling—Propagation from a Real Model 
to a Full-Scale System 


Johannes Brötz and Peter F. Pelz 


Models may be mathematical, but they may also be physical, i.e. scaled real models 
representing a full-scale component or system. The real model is usually scaled in size 
or material. Geometrically scaled models are common in architecture. In mechanical 
engineering, scaled models are equally gaining more and more relevance. When it 
comes to agile development, rapid prototyping is increasingly used resulting in scaled 
real models. 
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Fig. 4.34 Methods for predicting the function of a full-scale component using the example of a 
buckling beam 


Figure 4.34 shows two methods to predict the functionality of the full-scale com- 
ponent taking the example of a buckling beam: firstly, scaling from real model mea- 
surements; secondly, predicting the function of the full-scale prototype by means of 
a cyber model. This cyber model is a mathematical model of the component, e.g. a 
finite element model. 

Here, we focus on the first method, the scaling of the prototype’s function from 
model measurements. Compared to the cyber model, the advantage of the methodol- 
ogy presented here is that there is no need to consider the uncertainty of mathematical 
modelling, see Sect.2.2 So far it has remained an open question how to scale the 
uncertainty in shape and measurement of the physical model test to the full-scale 
component. 

State of the art for scaling are the four steps: (i) produce a scaled physical model, 
(ii) measure, (iii) undimension and (iv) scale, see Fig.4.35. When mastering uncer- 
tainty, it is no longer sufficient to only take the parameter uncertainty of a real model 
into account. In addition, the uncertainty must be scaled in a fifth process step, see 
Fig. 4.35. In this subsection we introduce a new methodology to propagate the uncer- 
tainty from a physical model to the real prototype. The beam and the related buckling 
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Fig. 4.35 Five steps in the process of scaling 


load are used as an application-related example being an important predefined func- 
tional restriction g < 0 of a load carrying structure. 

The following subsections describe the procedure of dimensional analysis, scal- 
ing and newly introducing the propagation of scaling uncertainty. We refer to the 
application of uncertainty scaling according to Vergé et al. [156]. 


Dimensional analysis 


The following recap of dimensional analysis is based on Spurk [148]. A system 
function g and/or quality F is prescribed by n dimensional physical measures p;, j = 


l,...,n. The unit of each physical measure p; is given as a monomial of the i = 
1,...,m base units P;. The dimension of the measure is 
m 
ip] = ||P”. (4.39) 
i=l 


The matrix A = (a; jhn „m 18 the dimension matrix being central in dimensional anal- 
ysis. The coefficients a;; are the exponents of the ith base unit for the jth physical 
measure. 


As a consequence of the Bridgeman’s postulate [24] the relation of pj, j = 


1,...,7, is equivalent to the relation of II, with r = 1,..., d dimensionless mea- 
sures. Each II, is a monomial of the j = 1,..., physical measures. 
n 
m, =[[p}, r=1.....d. (4.40) 
j=l 


The demand [II] = 1fora truly relative quantity yields 
ı=]]r*”, 7=1.....a. (4.41) 
j=l 


This is only satisfied for 
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i=l,...,m 
ajk;=0, jfol,...,n (4.42) 
| eee 


There are d linear independent solutions of this linear system of equations. From 
linear algebra we know thatd = n — rg(A), whererg(A) is the rank of the dimension 
matrix A = (4ii) n° 

As an illustrative example we look for the buckling load of a beam. The analytic, 
i.e. mathematical model goes back to Euler [43]. This analytic model is not in focus 
here. The buckling beam in Fig. 4.34 with fixed-free clamping is assumed to be a 
cylindrical beam of circular cross-section with nominal diameter D, length/, Young’s 
modulus £ and the second moment of area I. For predicting the demanded buckling 
load F, of the full-scale component we use the measured buckling load F of the 
physical scaled model. 

For the system there is only one dimensional product 


FÊ FP 


Fn(F.,1, ED) = 0 t= 
ee) = EI ~ ED? 


= const. (4.43) 


Scaling 


Scaling is used to predict the function g and quality F of the full-scale component. 
Not only geometric quantities, but other physical quantities, such as the buckling 
load F., can be scaled. The physical properties of the physical model P; (values of 
our physical model are marked by a prime) correlate with the full-scale p; by 


p; = pjMj, j=h...,n, (4.44) 


with the scaling factors M;. If the dimensionless products of a real physical and a 
full-scale model are equal, both are said to be similar [148]: 


nN, = M 


r’ 


eds, (4.45) 


If there is equality of all dimensionless products, we speak of complete similarity. 
With Eq. (4.44) and (4.45) we demand 


Laf] r= tins (4.46) 
j=l 


for complete similarity. 

For the beam we assume complete similarity in the dimensionless product II given 
in Eq. (4.43). Hence, using Eq. (4.46) we get the scaling factor Mr, of the critical 
buckling load F, 
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MM}, 
Mr, = Mm (4.47) 
The use of such a scaling law is straight forward: Usually the geometric scaling 
factors Mp and M; are known. The same is true for the scaling factor Mg for the 
Young’s modulus. Hence, the scaling law helps predicting the full scale function F, 
from the measured model function F. 


Uncertainty scaling 


In order to take uncertainty into account, the true value p; is given as the combination 
of the nominal value p; and the tolerance range 5p; for incertitut, cf. Sect. 2.3: 


py =D; +5p;, j=L...,n. (4.48a) 


With the definition of relative uncertainty U; := 5p;/p;, the true value is 


pj=pjAtu;), j=1,...,7. (4.48b) 


The same can be applied to the dimensionless products 


m, =0,| do), r=1,...,d. (4.49) 


j=1 


When considering uncertainty, the product of the scaling factors reads 


n 7 +U;\*i 
1ST [My = [Tm TT (FEE) rated 0) 
. j — J 


Since we assume complete similarity of the dimensionless products, Ii- M; =] 
applies. Hence, we obtain 


= 1+U; krj 
l= (= +) , r=l,...,d. (4.51) 


With Eq. (4.51) the uncertainty of the function and/or quality of a physical system 
can be calculated. The equation only needs to be solved according to the uncertainty 
sought. 

The manufacturing of the physical model of the full scale beam entails production 
tolerances. For uncertainty quantification, we refer to the ISO 2768-1 standard [33]. In 
ISO 2768-1 general tolerances are given for components not specified in great detail. 
Here the incertitude of the distribution is covered by intervals. For the physical model 
we choose a length l’ = 200 mm and a diameter D’ = 10 mm. We assume that the 
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material used is not changed. Hence, there is a complete similarity of the material 
Mpeg = 1. The uncertainty of the critical buckling load of the model U7, that is gained 
by model measurements, is defined for our example Up, = 0.085. With Eq. (4.51) 
the uncertainty of the critical buckling load results in: 


1+Up $ 1 Ur 
+ŁUp, = 1+Ur)-1. 4.52 
f: (2) = ( r) (452) 


Equation (4.52) shows that the ratios of the uncertainty of the model and full-scale 
parameters have an influence on the calculation of the full-scale function uncertainty. 
These ratios are multiplied by the term for the measured uncertainty of the model 
function. The uncertainty scaling is illustrated in Fig. 4.36. A geometric scaling factor 
Mp = M; = 1 represents our real physical model. For scaling factors greater than one 
(upscaling), the relative uncertainty decreases. This is due to higher precision being 
possible in manufacturing of large diameters and lengths. For downscaling, which 
is for lower geometric scaling factors, there is a strong increase in the production 
uncertainty. This affects the uncertainty of the critical buckling load Ur, of the beam, 
which shows a variation of higher range. Since the tolerances are defined for specific 
parameter regions, we obtain a discontinuous function for the uncertainty Up and 
U, and thus for U7.. 


Conclusion 


The analysis has shown that there is a strong need for uncertainty scaling. In the 
example of the buckling load, the relative uncertainty of the predicted function, the 
buckling load F., increases when scaling down. This has to be considered in the 
design, as it may otherwise lead to unforeseen failure due to the great uncertainty. 


4.3.7 Improvement of Surrogate Models Using Observed 
Data 


Sebastian Kersting and Michael Kohler 


Computer models of technical systems are playing a more and more important role 
in the design and construction of complex technical systems. Implemented as com- 
puter code, such models enable the use of so-called computer experiments, i.e. an 
experiment with the technical system is simulated via a computer program using 
the underlying mathematical model. An overview of the design and analysis of 
computer experiments can be found in [138] or [44]. In general, these computer 
models are imperfect, in the sense that they do not predict the reality perfectly, as 
discussed in Sect.2.2 There are several reasons, e.g. because of missing knowledge 
of underlying physical dependencies, or because of an approximation of those to 
reduce complexity. A typical example is neglecting the friction or considering it 
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Fig. 4.36 Uncertainty of the buckling load of the full-scale beam Ur, 


constant. Furthermore, in uncertainty quantification it is often required to perform a 
large number of computer simulations of an experiment with the technical system, 
which can be time-consuming, since typically these computer simulations are com- 
putationally expensive. A solution to circumvent this problem is to use a so-called 
surrogate model. There is a vast variety of literature on methods for estimating a sur- 
rogate model. For example [25, 31, 90] used quadratic response surfaces, [22, 32, 
77] investigated surrogate models in the context of support vector machines, [121] 
concentrated on neural networks, [17, 86] used kriging and [160] used Gaussian 
processes. In the following, a method is described, which is able to circumvent 
the challenges of the imperfectness and the computationally expensiveness of the 
computer model, by estimating an improved surrogate model, which has a smaller 
prediction error and is faster to compute than the computer model, as shown in [62, 
88, 91]. Furthermore, the improved surrogate model can then be used to quantify 
and analyse model uncertainty as shown in [164]. According to Fig.3.1 the method 
is applied in the product or system design phase (A). 


Mathematical setting 


The method, which will be described below is based on the following mathematical 
setting: Let (X, Y), (X1, Yı), (X2, Y2), ... be independent and identically distributed 
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random variables with values in R? x R, and let m: R? > R be a measurable 
function. Here X describes (random) inputs of an experiment with the technical 
system, Y the outcome of the experiment and m is a computer simulation of the 
experiment with the technical system, thus we use m(X) as an approximation of Y. 
Given the data 


(X, Yı), tey (Xn, Yn), (Kar, m(Xn+1)), sey (XntLy> m(Xn+1,)); (4.53) 


the aim is to estimate an improved surrogate model m,: R? — R of the computer 
simulation m. Note that the method implicitly assumes that the distribution Py of 
X is either known or that a large quantity of input values is available, i.e. stochastic 
uncertainty as described in Sect. 1.6 occurs. In an application, this is often not the 
case. How to circumvent this problem is described in Sect. 4.3.8. 


Method 


In the following, a method to estimate an improved surrogate model based on exper- 
imental data and a computer simulation is described. The method is based on the 
proposed estimators in [62, 88, 91, 164]. 

We start by estimating a surrogate model m; of the computer simulation m. There 
is a vast variety of methods (cf. [44, 138]). Here (penalised) least-squares estimates 
are used, defined by 


nt+Ly 
fir, () € arg min 7- 2 IX) —mXDP + penn) 454 
where F is a set of functions, (X;,m(X1)),...,(Xz,,m(Xz,)) is the set of input 


values evaluated with the computer model m of size L, € IN and pen? (-) is a penalty 
term which usually penalises the ‘roughness’ of the function and which is nonnegative 
for each f € F, i.e. pen? ( f) = 0. If the input dimension is smaller or equal to 3 
then smoothing spline estimates can be used for F as shown in [91]. For bigger input 
dimensions neural network estimates can be applied as in [62] or [88]. Of course, 
there exist other estimator function classes as discussed above. 

As discussed in Sect.2.2, usually every computer model has an inherent model 
error. To circumvent this problem, an estimator of the residuals is constructed by first 
calculating the residuals of the surrogate model with respect to the experimental data 


€i = Y; -mı (X) G@ =1,...,n) (4.55) 


and then applying a (penalised) least-squares estimate on this sample, defined by 


he , 1 n 
EC) € arg min > So I F(X) — ei? + pen? f), (4.56) 
5 i=l 
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where F is a set of functions. Finally, the improved surrogate model is a composition 
of the estimators above, defined by 


Hy (x) = My, (x) + AE) (x ER). (4.57) 


In case that only a small sample of experimental data is available, the estimator 
of the residuals (4.55) usually does not yield satisfying results. In this case, if an 
additional independent sample of input values Xy+1n+1, - - - » Xntintn, Of size N, € 
N is available, one can use a weighted (penalised) least-squares estimate instead 
of (4.56) defined by 


Nn 


Sif Xrti)? + pen, (f). 


i=1 


(1-w®) 
Nn 


(n) ” 

ms) € arg min — | f (Xi) — «il? + 
for Te Yj 

(4.58) 


where w™ € [0, 1] is a weighting term, which should be chosen data-dependent. 
Here, adding the weighted mean square of the euclidean norm of the vector 
(f (Xn+tn41), +--+» f (Xn+in+n,)) of function values of the additional sample is used 
as a regularisation. 


Application 


In order to demonstrate the usefulness of the above described approach, we apply 
it to the drop tests with the MAFDS, which are described in Sect.3.6.1; here we 
only consider the drop height as input variable and neglect the additional payload, 
as in [91]. The system outputs are the maximum relative compression Z, max. For F 
and F we use a smoothing spline estimator as implemented in the MATLAB routine 
csaps(). Asmoothing spline estimator depends on an additional smoothing parameter. 
In the estimation of ñz, this smoothing parameter is chosen by generalised cross- 
validation, cf. [157]. The smoothing parameter and the weighting parameter w” 
in the estimation of m are chosen by a k-fold cross-validation, cf. [68], where the 
smoothing parameter is chosen from the fixed set {2' : 1 © {-8,...,—1}} and the 
weighting parameter is chosen from the set {0,0.1,..., 1}. 

The result is illustrated in Fig.4.37. To conclude, we observe that model uncer- 
tainty occurs. The computer model overestimates the outcome of the experiments, 
whereas the improved surrogate model fits the experimental data quite accurately. 
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Fig. 4.37 Measured data (X1, Y}),..., (Xn, Yn) (black circles), computer model m (dashed line) 
and improved surrogate model m, (solid line) 


4.3.8 Uncertainty Quantification with Estimated Distribution 
of Input Parameters 


Sebastian Kersting and Michael Kohler 


Methods of uncertainty quantification are frequently applied in an experimental set- 
ting. This serves to quantify the uncertainty in the outcome Y of an experiment with 
a technical system, depending on an input X. This would be easy, if a large quantity 
of experimental data is available, but in most cases running experiments is expensive 
and time consuming. In order to circumvent this problem, one can use knowledge 
(e.g. physical knowledge) of the experiment with the technical system to implement 
a computer model m and use this to generate a data set of computer experiments. In 
this context, the input-output tuple (X, Y) is modelled as an R? x IR valued random 
variable, i.e. the experiment depends on a d-dimensional real valued input and has 
a real valued output. Then, if the input distribution Py is known, one can generate 
realisations of the input X and evaluate them with the computer model m to generate 
the data set 


(Xi, m(X1)),..., (Xn, m(Xn)) (4.59) 


of computer experiments. This data set can then be used as an approximation of 
reality to apply a method of uncertainty quantification, for example see Sect. 5.2.6. 
In the case that the computer model does not fit reality and a sample of experimental 
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data is available, one can also use the method described in Sect. 4.3.7 to construct an 
improved surrogate model, which then can be used instead of m. 

Frequently, we see the situation that the distribution Py is unknown and instead 
only a (rather small) data set of experimental data is available. In the following a 
method to estimate the probability density function g: R —> R of Y based on the set 
of experimental data and a computer model m: R? — R is described. Comparing 
the probability density function estimated by the method with an estimate of the 
probability density function based on the computer model enables the detection of 
model uncertainty. The method is according to Fig.3.1 applied in the product or 
system design phase (A). 


Mathematical setting 


The method described in the following is based on the subsequent mathematical 
setting: Let (X, Y), (X1, Yi), (X2, Y2), ...be independent and identically distributed 
random variables with values in R? x R, and let m: R? > R be a measurable 
function, i.e. stochastic uncertainty as described in Sect. 1.6. Here Y describes the 
outcome of an experiment with the technical system, X the (random) inputs of the 
experiment and m is a computer model of the experiment with the technical system, 
thus we use m(X) as an approximation of Y. Given the data 


(X1, Yi), ---, (Xn, Yn) (4.60) 


the aim is to estimate the probability density function g: R — R of Y. Note that to 
apply the method described below, it will be necessary that the evaluation of m on 
specific input values is possible. 


Method 


The method described in the following is based on [88], which is an extension of [62, 
91]. In the following, we will assume that X is multivariate normally distributed 
to estimate its distribution and generate a sample based on this estimated input 
distribution. An overview of methods to generate a data set based on a specific 
class of distribution can be found in [35]. 

In order to estimate the parameters of the distribution Py of X, a maximum 
likelihood estimate based on the data (4.60) defined by 


1 n 
N 4.61 
h=- 2 (4.61) 
and 
S (L(y OO _ gw 462 
an ( k u )( k u’) (4.62) 
k=1 1<i, j<d 
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is used, where X w) denotes the ith component of the d-dimensional random variable 
Xœ. Alternatively, one can use the unbiased version of (4.62) defined by 


5 i 2 uch ee 
= (; SEP RR” - a») ; (4.63) 
lsi j<d 


k=1 


Given these estimators of the parameters u and & of the input distribution Px, a 
sample of size N„ = Nn; + Nn,2 € IN can be generated which is independent and 
multivariate normally distributed with mean ü and covariance È. Therefore, we first 
generate an independent sample Zı,..., Zn, of d-dimensional vectors, where for 
each vector the components are independent and standard normally distributed, and 
set for every i = 1,..., Nn 


X; = OA'z, + A, (4.64) 
where O and A are defined by the eigendecomposition 
Ê = ÔÃ ÔT (4.65) 


of È. Here A= diag(A1, os ce Aaya is a diagonal matrix consisting of eigenvalues of 
È and Ô is an orthogonal matrix whose columns are eigenvectors of È. 
To estimate an improved surrogate model m, of m we use the method described 
in Sect. 4.3.7, with a few minor changes. To estimate the surrogate model m,, of m 
we first generate the data set 
Uns» oF er (4.66) 


of size L, € IN, where the values in this set are independent and uniformly distributed 
on the centred cube B, := [—c- (log Ln), c - dog L,)|¢, for some suitably chosen 
constant c > 0. This set is then used to construct the surrogate model m, of m, i.e. 
we define the estimator by 


Ln 
fir, © = argmin — J |f Vin) — min)? + per2(f) (4.67) 
i feF Ly & l ne 


where F is a set of functions. In case the data set (4.60) is sufficiently large, the 
estimator of the residuals can be defined as estimate (4.56) in Sect. 4.3.7. Otherwise 
we make a modification of estimate (4.58) from Sect. 4.3.7, where we replace the 
sample of additional input data by the first N, ı of the generated input data, i.e. the 
estimator is defined by 


wer) die w™ 
2 If (Xi) - <il + S 


m;,(-) € arg min 
fer 


> IF)? + penz(f), (4.68) 


n, 
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where F is a set of functions. 
The improved surrogate model is constructed as in Sect. 4.3.7, i.e. it is defined by 


My(x) = ML, (x) + Aex) (eR). (4.69) 
In order to estimate the probability density function g of Y, the kernel density esti- 


mator of [123, 135] is applied on the sample m, (XN, 41)». Hin(Xw, 14 0,2), Le. it 
is defined by 


Nn.1+Nn.2 A “9 
Mr 1 \ f N m„(Xi) 
ne KR am 
= Nn2 : An,» 2, hy, 


for some bandwidth hy,, > O and some kernel K: R —> R, which is usually 
chosen as a symmetric and bounded density, e.g. the Gaussian kernel K (t) = 


Tm exp(— 5 t°). 
Application 


As an example we consider a lateral vibration attenuation system with piezo-elastic 
supports. A visualisation of the technical system can be found in [103, Fig. 1]. 

This system consists of a beam with circular cross-section embedded in two piezo- 
elastic supports A and B. Support A is used for lateral beam vibration excitation 
and support B for lateral beam vibration attenuation, as proposed in [61]. The two 
piezo-elastic supports A and B are located at the beam’s end; each consists of one 
elastic membrane-like spring element made of spring steel, two piezoelectric stack 
transducers arranged orthogonally to each other and mechanically prestressed with 
disc springs, as well as the relatively stiff axial extension made of hardened steel that 
connects the piezoelectric transducers with the beam. For vibration attenuation in 
support B, optimally tuned electrical shunt circuits are connected to the piezoelectric 
transducers [63]. 

Our aim is to quantify uncertainty, i.e. to estimate the probability density function 
of the maximal amplitude of the vibration occurring in an experiment with this 
attenuation system. Five parameters vary during the construction of the attenuation 
system and influence the maximal vibration amplitude: the lateral stiffness k,.,,, and 
Kiat,z in direction of y and z, the rotatory stiffness k,or,y and k,or,. in direction of 
y and z, and the height of the membrane hy. In our setting these five values are 
the input X of the experiment with the technical system. A computer model (above 
denoted by m) is available with which we can compute an approximation m(X) of 
the maximal vibration amplitude Y to a corresponding input value X. To apply the 
density estimator (4.70) we measured the corresponding parameters for ten real built 
systems. As a result we got the data in Table 4.4. 

Since the parameters vary in scale, it does not make sense to estimate the surro- 
gate model m ;, on U;„ ~ U([-c - log(Ln), c- log(L,)]®). Instead we rescale the 
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Table 4.4 Measured data for the ten built systems. The values of k;-;,y and k;o;,z are given in 
Nm/rad, the values of kjar,y and kjat,z are given in N/m, the values of hy are given in m and the 
values of the maximal vibration amplitude y are given in = /V 


kror,y x 10° 11.31 | 1.34 
korg x 10% |131. | 1.28 
kiat,y x 107 13.27 | 3.28 
katz x 107 |3.07 | 3.22 
hx x 10-4 |6.79 |6.77 |6.82 |6.80 |6.79 |6.76 |6.81 |6.74 |6.68 | 6.84 
y x 10! 145 |142 |144 |142 |143 |1.35 1147 |132 |1.31 | 1.63 


probability density function 
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Fig. 4.38 Density estimator based on surrogate model (dashed line), density estimator based on 
improved surrogate model (solid line) and as reference the data Yı,..., Y„ indicated on the x axis 


components of U; „ so that for each component uD ~ UA- 2. Jai. AO + 
2- ./6;;]) holds. 

We apply the density estimator (4.70) to the data and obtain as a result Fig. 4.38, 
where we compare it to a density estimator based on the surrogate model m;,. 
The result shows that the estimator based on the improved surrogate model fits the 
data better, i.e. the improved surrogate model is able to predict the reality more 
accurately than the surrogate model; hence the density estimator is more accurate. 
Model uncertainty occurs which leads to the conclusion that the computer model 
does not fit reality. 
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4.4 Representation and Visualisation of Uncertainty 
Moritz Weber, Georg Staudter, and Reiner Anderl 


Product development is a knowledge-intensive process where, despite its uncer- 
tainty [42, 95, 106], designers define what the product has to achieve in the physical 
domain and how this has to be accomplished, potentially, according to customer 
specifications, cf. Sect. 1.2. As to the definitions it is determinated which tests are 
necessary, how and in which quantity the product must be manufactured and at what 
time it needs maintenance. Uncertainty may have negative effects on decisions, which 
can lead to over-sizing, unfulfilled customer demands and unforeseen failures [74]. 
As pointed out by Anderl et al. [6], software applications used in the engineering 
context rarely consider uncertainty quantification, which partly explains the lack of 
awareness about uncertainty by designers. This section introduces our approach to 
overcome this issue by visualising uncertainty and its consequences for developers 
and the required digital representation of knowledge about uncertainty. This aims 
to support engineers and designers to better understand uncertainty regarding prod- 
uct and process properties, and thus helps the engineers to recognise, evaluate and 
analyse uncertainty in their designs (cf. Sect. 1.7). 

A three-layer architecture that includes representation, presentation and visuali- 
sation of uncertainty [6] is the basis for the approach introduced in this section. The 
representation layer is dedicated to the digital representation of data uncertainty with 
all of its subtypes (cf. Sect.2.1). For this purpose, it uses an ontology-based infor- 
mation model, see Sect.4.4.1. The presentation layer serves as an auxiliary layer 
for the visualisation and creates use-case defined objects, which serve as an inter- 
mediate representation for visualising uncertainty. The concept of uncertainty cloud 
(uCloud) enables the tangible presentation of geometric tolerance uncertainty. To 
this end, it creates an Euclidean space that describes the probability distribution of a 
body existence of a physical part [6]. The visualisation layer uses the instances of the 
presentation layer and maps its objects into the functionality of computer graphics, 
see Sect.4.4.2. The MADFS (see Sect. 3.6.1) serves as an application example for 
the outlined approach and its methods, see Sect. 4.4.3. 


4.4.1 Ontology-Based Information Model 
Moritz Weber and Reiner Anderl 


For the purpose of identifiying the uncertainty in early stages of the product devel- 
opment process and thus enabling uncertainty management, information about all 
product life cycle phases is necessary. Therefore, a suitable model is required to dig- 
itally represent information about uncertainty. The ontology-based approach offers 
the opportunity of an appropriate conceptual space based on scientific knowledge 
about uncertainty. In addition, it provides high semantic value. 
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Ontologies are defined as “formal models of selected aspects of the real 
world” [67]. They digitally represent objects or assets and their relations for the use 
in advanced applications of information and communication technology. Ontologies 
are designed for the specification of semantics of higher-order to enable knowledge 
representation. Ontologies use triples to formalise information. Each triple comprises 
subject, predicate, and object. 

For authoring the ontology, we use a variant of the Web Ontology Language in 
version 2 (OWL 2). OWL 2 is standardised by the World Wide Web Consortium 
(W3C) and comprises three language variants of various expressive power. Here, we 
chose the variant OWL Description Logics (DL), since it comes with the greatest 
possible expressive power, while maintaining the computational completeness and 
decidability necessary for inference and validity checking. OWL 2 supports seri- 
alisation using the Extensible Markup Language (XML), which enables the easy 
exchange of information. A further advantage of OWL 2 for dealing with uncer- 
tainty and especially ignorance is the Open World Assumption made by OWL 2, so 
a statement can be true irrespective of whether it is known to be true [64]. 

Since ontologies are based on description logic, so-called inference machines can 
infer new knowledge based on already known information. In addition, they can be 
used to verify the integrity of the knowledge [7, 20]. An ontology comprises an 
Assertional Box (A-Box) and a Terminational Box (T-Box). The T-Box formalises 
the knowledge about the concepts—also called classes—of the described domain, 
whereas the A-Box contains the knowledge about the specific instances of these 
concepts in the domain. 

This section describes the information model used for the exchange and visual- 
isation in load-bearing systems and therefore forms the fundament for the methods 
described in Sect.4.4.2 and Sect.4.4.3 and is therefore a contribution to the mod- 
elling of uncertainty in information technology. Figure 4.39 provides an overview of 
the ontology-based information model named Collaborative Ontology-based Prop- 
erty Engineering System (COPE), which we have developed with its major com- 
ponents [145]. It incorporates the property-driven development approach [162] 
and comprises the three life cycle phases development, production, and usage 
(cf. Sects.3.2 and 1.7). Data uncertainty is characterised as uncertain property value 
and uncertain relationship that specifies the effect of the uncertain value. The product 
model and a process model define the context of these two components. A major 
approach of the ontology is property and process classification. The following para- 
graphs describe four of the major components of the ontology-based information 
model “COPE” in more detail. 


Uncertain property value 


For the representation of the uncertain property values, we have developed a partial 
model referred to as ‘Uncertainty Data Type’ (UDT) [146]. Its aim is to represent 
digitally the uncertainty of product and process properties to improve the inter- 
changeability of these data types. The approach is based on the digital uncertainty 
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Fig. 4.39 Overview of COPE [145] 


representation introduced and discussed in Sect. 2.1, and it covers all three types of 


data uncertainty described there. 
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Uncertain relation 


Multivalent directed relations represent the dependencies on uncertain causal con- 
nections in the ontology. Thus, it is supported to define the distinct relationship types 
and to parametrise the relations individually. These relations can refer to both, the 
nominal value and the distribution of the uncertain property [147]. 


Process model 


Processes are highly important in the context of uncertainty, and therefore processes 
are integrated to the main parts of the information model. Four values characterise 
processes. The Name of the process describes its type semantically (e.g. drilling, 
landing). Appliances are resources that the process needs but does not consume (e.g. 
drill, light aircraft). In- and Output represent the transformation by the process (e.g. 
speed, load). The last value comprises influencing factors. They are structured into 
disturbance, information, resources, and user (e.g. temperature, energy, qualifica- 
tion). 

Standardised terminologies are used as far as possible within the process model. 
For production, we use the classification given by DIN 8580 [34]. It provides an 
overview of production processes, such as forming and drilling. In contrast, the usage 
processes depend on the used product. For the application of load-bearing structures 
in mechanical engineering, such a standard is not available. Therefore, the developer 
must anticipate the potential processes of the product during the development phase 
and specify them further later. 


Product model integration 


The information model is integrated into the product model for two reasons. It refer- 
ences the uncertainty in the integrated product model and is used to assign uncertain 
property values to parts of the product model. This approach enables unique iden- 
tification throughout all life cycle phases and improves the usability of uncertainty 
information. Furthermore, the integration into the product model provides an appro- 
priate basis for the visualisation of the uncertainty information (see Sect.4.4.2) in 
the respective product context. The item references entities of the Boundary Repre- 
sentation (BRep) to localise the uncertainty information. 

The ontology-based information model extends the product model based on 
ISO standard 10303-108 for parameterisation and geometric boundary conditions 
of explicit product models of parts and assemblies. In this context, the ontology 
constitutes the T-Box. Specific CAD models and attached data constitutes the A- 
Box. The definition of uncertain geometric entities results in a geometrically under- 
determined state in the A-Box. Systems of equations cannot further characterise the 
relations between the geometric entities without reducing the degrees of freedom 
of the geometric entities and thereby removing the information of the geometric 
variation. The A-box describes geometry and topology of the geometric entities and 
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Fig. 4.40 a Representation of points in the information model and b visualisation in the CAD- 
model 


allows the characterisation of the solutions of the system of equations, which are 
algebraically identical but geometrically different. 

For the processing of time-variant uncertainty information (see Sect. 3.4), we have 
developed a concept with the corresponding implementation for the bidirectional 
connection of a CAD system (Siemens NX), and a numerical linear equation system 
solver (Matlab). The ontology serves as a mediator between the two systems so that 
the results of the ontology queries are applied in the CAD system, as well as in 
Matlab. The representation of time-variant uncertainty extends the A- and T-Box 
representing design variants in the parametric product model. Furthermore, time- 
variant changes in the geometry of assembly components are also represented [168]. 
Figure 4.40a shows a graph-based visualisation of a small section of the information 
model. It shows individual points and their connections. Circular symbols indicate 
concepts, and diamonds indicate specific instances. This example depicts a point 
with its three Cartesian coordinates and four points derived from it. The derived 
points represent possible corner points after production and after consideration of the 
uncertainty. The figure equally shows a small part of the class hierarchy. Figure 4.40b 
is a visualisation of the CAD-Model and a larger quantity of derived points for 
selected vertices. A designer interprets the selected geometry and decides whether 
the boundary conditions meet the requirements. 

The automated generation of the T-Box is based on the software OntoStep devel- 
oped by the National Institute of Standards and Technology (NIST) [96]. This soft- 
ware tool has been extended for the extraction of product parameters for the genera- 
tion of the instances. In this way, data sets concerning uncertainty and its distributions 
are integrated. 

The ontology-based information model was also adapted for a specific 
domain [170]. Here, we extended the ontology for the application scenario Uncer- 
tainty Mode and Effects Analysis (UMEA) for human effects in aerospace. UMEA is 
an extension of the failure mode and effects analysis (FMEA), and was proposed by 
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Engelhardt [41]. Besides our own extensions, domain-specific [8] and cross-domain 
(e.g. Dolce UltraLight [110]) ontologies were used. Thus, we could confirm that 
the ontology-based information model can be contextualised and reused in further 
specialised use-cases. 

As a further extension of the ontology-based information model, the automatic 
extension of the knowledge base and the automatic classification of contradictory 
data were taken into account. The methods used for this purpose comprise ontology 
matching and inductive reasoning. 

For inductive reasoning, methods of pattern recognition and clustering extend 
reasoning. Entities are classified with respect to similarity with the result that new 
inferences are possible [163]. In consequence, however, this classification and the 
knowledge acquired is uncertain. Nevertheless, this knowledge enables improve- 
ment of product development decisions. Therefore, the designer is provided with the 
inferences including a measure of confidence. Ontology matching is applied to inte- 
grate knowledge from heterogeneous and distributed sources automatically. Thereby, 
analogies between two or more ontologies need to be identified and used to join the 
knowledge. 

Domain-specific rules for ontology matching and inductive reasoning of axioms 
of geometric relationships are the core of the integration of both methods in the 
ontology-based information model. This enables the integration of methods to detect 
and control data and model uncertainty into the ontology-based information model. 

We presented an ontology-based information model that combines domain- 
specific knowledge to support product developers. In addition, it provides a basis 
for further analyses and the visualisation of the effects of uncertainties. We chose an 
ontology-based information model that is based on description logics and OWL 2. 
Thereby, the advantages of an expressive, descriptive language are combined with 
those of decisive formal semantics. In contrast to alternative forms of data repre- 
sentation, such as databases, ontologies not only allow data queries but automated 
classification, validation of the integrity of data, and extension of the knowledge 
base by inference. Furthermore, due to the high semantic value, knowledge interpre- 
tation improves, and the exchange of information is simplified. The ontology-based 
information model offers a functionality to store not only time-invariant but time- 
variant information about uncertainty, too. Furthermore, instances can be generated, 
and ontology matching and inductive reasoning can extend the knowledge automati- 
cally. The use of an ontology-based approach allows to extend the information model 
further. The integration into a digital twin, for example, can enlarge the knowledge 
base and thus increase the quality of product development decisions, see Sect. 4.4.3. 
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4.4.2 Visualisation of Geometric Uncertainty in CAD Systems 
Georg Staudter and Reiner Anderl 


The visualisation of geometric uncertainty comprises the graphical presentation of 
the statistical distribution of data obtained from measurements conducted during 
production and usage, by utilising the functionality of computer graphics [47] to 
generate an appropriate appearance of uncertainty [6, 84, 154]. The following section 
introduces our approach for the visualisation of the geometric uncertainty in CAD 
(computer-aided design) systems, focusing on stochastic data uncertainty associated 
with geometrical model parameters, see Sect.2.1. The visualisation of uncertainty 
is part of the middle layer of the framework of mastering uncertainty introduced 
in Sect. 1.7 and thus, an important element within the analysis, quantification and 
evaluation of uncertainty in mechanical engineering. 

Despite the fact that the consideration of uncertainty associated with geometry 
is crucial during the design process, today’s CAD systems provide only a limited 
design-oriented view with functionalities to specify nominal geometry and geomet- 
ric tolerances. There is still a lack of functionalities for the visualisation of geo- 
metric uncertainty [6]. The effect of the different geometric tolerances on the part 
(e.g. shape, dimensions, features, locations) cannot be graphically visualised either. 
Advanced tools, such as Computer-Aided Tolerancing (CAT), focus mainly on geo- 
metric dimensioning and some basic stack-up analysis, but do not provide harmonised 
solutions for the graphical visualisation of tolerance and uncertainty associated with 
measurement. Therefore, there is a need to integrate geometric uncertainty in the 
geometric product model in order to explicitly depict uncertainty [6, 145]. 

Our approach for the visualisation of geometric uncertainty focuses on the inte- 
gration of information about uncertainty and its correlations into CAD-systems via 
an ontology-based information model. Therefore, the geometric product model rep- 
resenting the 3D-CAD model is decomposed into appropriate elements, such as 
features and boundary representation elements (BREP-elements), which enable the 
association of uncertainty. The hierarchical structure of the product model, as well as 
its uncertainty information, are mapped into the ontology-based information model 
in terms of a product and process representation, see Sect. 4.4.1. The mapping assures 
that the product model can be transformed into an ontology-based representation and 
vice versa [6, 116, 145]. 

When integrating information about geometric uncertainty into the product model, 
it is necessary to do both, specifying uncertainty explicitly and deriving a presen- 
tation appropriate for visualisation. For the presentation of geometric uncertainty 
associated with tolerance, we have developed the concept of the uncertainty cloud or 
“uCloud”. The uCloud concept creates a three-dimensional space that visualises the 
probability distribution of the physical part surface location. The uCloud is generated 
by a set-theoretical operation, which compromises two volumes, each representing 
a maximum, respectively minimum value of a particular geometrical property [6]. 
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The resulting uCloud element is then used to apply visualisation techniques for 
geometric tolerances. Conceptually, visualisation techniques are divided into the 
domains of (i) graphical, (ii) symbolic, (iii) structural and (iv) verbal visualisa- 
tion [6]. 

(i) Graphical visualisation uses functionality of computer graphics, such as colour, 
colour intensity, transparency or coloured patterns. To attach the semantics of uncer- 
tainty to the graphical appearance of uncertainty, a cross-reference table is needed [6]. 
(11) Symbolic visualisation associates predefined symbols to presentation objects, and 
it enables the attachment of uncertainty information. In the domain of (iii) structural 
visualisation presentation objects are mapped onto structures, such as lists, tables, 
tree- and graph-structures. (iv) Verbal visualisation expresses uncertainty lexically 
and creates a textual output using the ontology approach [146, 147]. Figure4.41 
shows graphical visualisation techniques for uncertain properties and their uncertain 
value description with respect to the Uncertainty Data Type (UDT). 

With the concept of uCloud combined with visualisation techniques for uncer- 
tain geometric properties, we provide an approach for the static visualisation of 
time-invariant uncertainty on individual parts by creating a cloud-like space, which 
contains the part surface of the real product. The result is a visualisation through 
transparently shaded offset bodies, which are linked to the corresponding UDTs 
(Uncertainty Data Type). Additionally, uncertainty information related to product 
structures such as lists, tables or tree structures can be displayed. 

Figure 4.42 shows the uCloud approach for a geometric deviation of the diameter 
of a shaft with different types of uncertain value descriptions resulting from manufac- 
turing process specific tolerances. Figure 4.42a illustrates the uCloud for an interval, 
or more specifically for a geometric tolerance, where an upper deviation, a nominal 
diameter and a lower deviation are graphically visualised [145]. With respect to this 
information, the diameter of the manufactured surface of the shaft lies within the 
transparent shaded offset. Since the geometric deviations are small in relation to the 
dimension of the shaft, the technique of enlarged detail, known from technical draw- 
ings, is used. This approach is also available for visualising stochastic tolerance data. 
Therefore, a sigma level (e.g. Six Sigma) or a confidence interval of the distribution 
function (e.g. 99.9997%) is selected, depending on the available input data. Both 
sigma levels and the expected value result in three characteristic points, as indicated 
by an additional specific symbol [145]. 

Figure 4.42b shows the visualisation of the geometric deviation of the diameter of a 
shaft with stochastic uncertainty information regarding its geometric tolerance. With 
a given histogram as an input, the colour density range is mapped onto the minimum 
and maximum frequency, and it is visualised by elements which correspond to the 
classes of the histogram. The element colour density corresponds to the probability 
distribution given by the representation of the histogram. In the case of a given 
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Fig. 4.41 Graphical visualisation techniques for different types of uncertainty (a) in relation to the 
UDT (b) 


distribution function, the uCloud element colour density is mapped to the probability 
of the function [6]. 

Each uCloud element has to be generated respectively to the given type of the 
uncertainty value description. With the approach of a sectional view we enable engi- 
neers and designers to interpret different influences, which occur in the product life 
cycle, such as imperfect manufacturing, wear and corrosion. Engineers are able to 
interpret uncertainty occurring within a single part or an assembly. Furthermore, the 
uCloud concept complements the 3D data model without manipulating the idealised 
description of the geometry allowing its further usage for e.g. Finite Element Method 
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(b) 


Fig. 4.42 uCloud for the visualisation of time-invariant uncertainty with a interval-, b histogram- 
and distribution-based geometric tolerance information based on [6] 


(FEM) or Digital Mock Up (DMU) analysis [145]. Detailed information and further 
visualisation examples are available in [6, 145, 147]. 

Geometric uncertainty is not only crucial in the context of individual parts. The 
effects of component properties affected by uncertainty also appear in the context 
of assemblies, in which individual uncertainties are mutually influential and inter- 
dependent. A typical example is the tolerance stacking of geometric manufacturing 
tolerances. In order to make uncertainty information about afflicted part properties 
available throughout the entire assembly, this information is attached to elements of 
the topology of the 3D CAD-model as attributes described by Product Manufactur- 
ing Information (PMI) [74]. PMI comprises non-geometric information and aims at 
providing annotations for 3D geometric models [74]. It is typically used to describe 
additional properties to define the product geometry more precisely, primarily for 
manufacturing purposes such as manufacturing tolerances. PMI also refers to any 
data that is linked to geometry or topology of a 3D CAD-model [74]. 

For the purpose of visualising geometric uncertainty in assemblies, PMI is 
attached to topology entities of the 3D CAD-model and specified for object-oriented 
implementation. In this context, the target topological entities for referencing PMI 
are body-, face-, and edge-attributes, as they are important for assembly constraints. 
The body-attribute serves as an individual part specific information carrier and con- 
tains all information from face- and edge-attributes, that belong to an entire body. 
Through the configuration of individual parts via assembly constraints, the body- 
attributes associate corresponding parts with one another and enable bidirectional 
PMI exchange [74]. One individual part contains exactly one body-attribute but 
multiple face- and edge-attributes; these comprise uncertainty information mapped 
into a specific PMI being associated with the afflicted object property. The ontology- 
based information model provides the informational context, which is linked to the 
different attributes [74]. 

Object attributes for edges refer to the information for the mathematical descrip- 
tion of the geometrical instance of the edge in a three-dimensional space. Object 
attributes for faces reference information for the corresponding surface, such as: 
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Fig. 4.43 Informational context for the connection of single parts with assembly constraints based 
on [74] 


direction of the normal surface, radius and central axis of cylindrical surfaces, surface 
contents as well as the mathematical description of the surface and the uncertainty 
type in relation to the geometric deviation [74]. Thus, the geometric deviation in the 
x-, y- and z-direction in a three-dimensional space is described. Object attributes for 
bodies collect the information from attributes attached to a part’s surfaces and edges 
to provide a complete attribute bundle for the neighbouring parts. In order to reference 
individual parts within an assembly, the designer assigns assembly constraints, refer- 
ring to different reference elements. Figure 4.43 illustrates the interlinking between 
attributes, individual parts, assembly constrains and configuration logic. 

Through the referencing of two individual parts using an assembly constraint, 
the body-, edge- and face-attributes of the individual parts are automatically linked 
bidirectionally with one another [74]. As a result, PMI containing geometric uncer- 
tainty are referenced to the neighbouring part. The configuration logic for assembly 
constraints defines how the geometric uncertainty is being propagated into the neigh- 
bouring parts. With the help of object attributes and their internal processing in the 
ontology-based information model, the concept of uCloud can be extended from 
single parts to assemblies. Combined uncertainty zones of individual parts within an 
assembly are visualised with respect to an absolutely positioned, freely selectable 
individual part. The validation of the concept, applied to the MAFDS (see Sect. 3.6.1), 
is outlined in Sect. 4.4.3, see [74]. 
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4.4.3 Digital Twin of Load Carrying Structures 
for the Mastering of Uncertainty 


Georg Staudter and Reiner Anderl 


The digital representation of physical objects (e.g. a product, a production system, 
a test rig), as well as the biunivocal relationship between such physical objects and 
their equivalent digital counterparts are subject to the digital twin concept, together 
with the cyber-physical system approach [59, 115]. Having a digital twin allows 
defining, simulating, predicting, optimising and verifying the objects along their life 
cycle phases, from conception and design, via production, to usage and servicing. 
Along the life cycle phases, different types of models are created and used to repre- 
sent physical objects, e.g. system models, functional models, 3D geometric models, 
multiphysics models, manufacturing models, and usage models, see Sect. 1.3. These 
models constitute the digital twin. 

The transfer of data from the physical domain to the digital domain is a key 
approach to generate the digital twin. In the widest sense, a digital twin requires to 
implement a data flow where data, acquired from testing, production, maintenance 
and operation are integrated into a digital domain to support such models and assist 
in predictive and decision-making processes, see Sect. 1.4. This section addresses the 
challenges of mastering uncertainty associated with the respective data (Sect. 2.1) and 
models (Sect. 2.2 and introduces our approach to the visualisation of data-induced 
conflicts (Sect. 4.2) for uncertainty identification (Sect. 3.3) in the digital twin context. 

The benefits derived from the digital twin implementation, depend on incorporat- 
ing data from the physical domain into the digital domain. In the physical domain, 
data acquisition requires measuring physical magnitudes. The result of measure- 
ment should be a threefold structure: nominal value of the magnitude, measurement 
unit, and uncertainty of the measurement [18]. The most widely used data quality 
dimensions are: accuracy, completeness, currency, and consistency [15]. Within the 
accuracy dimension, the uncertainty of a measured magnitude is a significant con- 
tributor to the indicator of the data validity, see Sect. 2.1. However, literature shows 
that explicitness of the uncertainty of measured data is still a challenge. There is a 
lack of bidirectional semantic harmonisation of the uncertainty representation in the 
standards used to transfer data, both from the digital domain to the physical domain 
and vice versa [134]. 

Geometric data obtained from the physical domain are used to recreate 3D geo- 
metric models of the physical objects. In the literature, these models are named 
with the terms as-built, as-fabricated and as-manufactured [28, 59, 153]. The aim 
of having an as-manufactured 3D model is to represent the geometric deviations 
caused by the manufacturing processes and use the model representation to perform 
simulations that previously were executed using an as-designed 3D model. Conse- 
quently, it is necessary to explicitly represent the uncertainty of the reconstructed 
as-manufactured 3D model, see Sect. 2.2 
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Fig. 4.44 Virtual 
Demonstrator of the MAFDS 
from Sect. 3.6 in Siemens 
NX 


Measurements are necessary to capture the main geometrical dimensions of the 
physical components. We used measurement results with their corresponding uncer- 
tainty to create a3D model of the physical test rig MAFDS (see Sect. 3.6.1) referred to 
as the virtual demonstrator. The virtual demonstrator includes material and physical 
properties in addition to part geometries and product structures. It consists of a Multi- 
Body-Simulation (MBS) model with a set of virtual sensors to simulate the func- 
tional behaviour while visualising the behaviour and movements of the test rig. The 
dynamic analysis allows the determination of velocities, accelerations and displace- 
ments of the moving components, as well as the reaction forces. Figure 4.44 shows 
the implementation of the virtual demonstrator in Siemens CAD-System NX12. 

Internally, the moving components, joints and drivers are converted into a math- 
ematical system of differential equations, which can then be solved to determine the 
desired quantities. This can be performed using different solvers which depend on 
the respective CAD-system and are mostly proprietary. Additionally, moving com- 
ponents are simplified to their mass, inertia properties and geometrical dimensions, 
while deformation properties are neglected. This leads to a major challenge for the 
quantification of the respective model uncertainty [5]. 

In the context of a digital twin, another effect that must be taken into account 
for MBS is the influence of geometric tolerances of the physical component, see 
Sect.4.4.2. Since such effects are often not taken into account, it may appear, for 
instance, that an interference fit situation occurs in the simulation, when in reality 
there is a slight clearance in the joint or vice versa. Therefore, it is not only neces- 
sary to explicitly represent the uncertainty of the reconstructed as-manufactured 3D 
model, but to consider effects, such as the classical tolerance stacking of geomet- 
ric manufacturing tolerances in assemblies. With the help of object attributes and 
their internal processing in the ontology-based information model, as outlined in 
Sect. 4.4.2, the concept of uCloud allows the visualisation of combined uncertainty 
zones of individual parts within an assembly. 

Figure 4.45 shows the visualisation of an uncertainty zone by the bidirectional 
exchange of information about stochastic data uncertainty associated with geomet- 
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rical model parameters between individual parts with a maximum deviation due to 
overlapping forms of geometric uncertainties in the subassembly of the upper struc- 
ture of the MAFDS. 

The uncertainty zone visualises the possible geometric deviation resulting from 
cumulative manufacturing tolerances of the individual parts in the context of assem- 
bly constraints as faceted bodies. The object attributes of the topology elements con- 
tain information about geometric uncertainty, such as the divergence between actual 
and target geometry or surface roughness. Using the concept of object attributes, it 
is also possible to consider non-geometric properties, such as damping properties 
and spring stiffness, with uncertainty ranges in order to simulate product behaviour 
under uncertainty [169]. 

In general, the digital twin concept aims at integrating measured data acquired 
from testing, production, maintenance and operation into the digital domain to assist 
in decision-making processes. These processes depend strongly on the quality of the 
underlying information base. The data to quantify and evaluate a system response is 
typically gathered by a variety of sensors, see Sect. 1.4. Because of the complexity of 
the context, several data streams must be integrated, and possible data-induced con- 
flict situations must be identified, see Sect. 4.2. To identify a possible erroneous sensor 
behaviour, values of interest are observed redundantly in the physical domain. The 
objective is to avoid situations where possible errors remain unnoticed, see Sect. 4.2.1. 
Redundancy increases the availability of information and thus, contributes to the 
verification of the data. On the other hand, if several sources provide inconsistent or 
conflicting data, a defective interpretation may occur. Therefore, it is necessary to 
provide methods for explicitly representing and visualising data-induced conflicts in 
the digital twin context, see Sect. 4.2.3. 

Section4.2.1 presents a methodology for the identification of data-induced con- 
flicts and the interpretation of conflicting sensor data. The approach is based on dif- 
ferentiating data sources, such as soft sensors, into models and sensors, by spanning 
the investigation from the redundant observation of a single value to the interconnec- 
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Fig. 4.45 Visualisation of geometric deviation of individual parts in assemblies based on [74] 
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Fig. 4.46 Concept for the visualisation of data-induced conflicts in Siemens NX 


tion between models and sensors throughout a technical system. Here, the proposed 
methodology is applied to the virtual domain for the purpose of the visualisation of 
data-induced conflicts in CAD systems, see Fig. 4.46. 

In addition to information on components, such as dimensions and parameters 
with their respective uncertainty, the information model represents the underlying 
sensor system as well as models for generating analytical redundancy. Each sensor 
of a physical test rig is represented by its metadata, including identification data, cal- 
ibration data, known uncertainty, as well as relative and absolute placement within 
the test rig. Soft sensors are used to convert the measured data values and to gener- 
ate analytical redundancy, see Sect. 1.4. In order to represent information about the 
models, system knowledge, such as symmetry characteristics and orientation of the 
system components, are integrated into the information model. 

The information model is the basis for the data evaluation and is as such imple- 
mented in Matlab. The prototype development comprises also methods and classes 
for the propagation and calculation of the resulting uncertainty. The result is a soft- 
ware tool for the automatic detection of data-induced conflicts, see Sect. 4.2.3. The 
output of the system provides detailed information on data-induced conflicts, as well 
as on the interconnections between models and sensors throughout the system. In 
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addition, the prototype software tool allows to generate statistics for each sensor, 
providing information on the total amount of redundant observations (comparisons) 
including sensing, as well as the total percentages of confirmations and conflicts with 
other sources. Assuming that the models describe the system behaviour with suffi- 
cient accuracy (Sect. 2.2, the trustworthiness of the respective sensor is visualised in 
the form of a histogram. 

The virtual demonstrator is interconnected via Siemens NX’s application pro- 
gramming interface (API) NX Open with the prototype data evaluation tool imple- 
mented in Matlab. The information model allows to map metadata of the sensor 
system as well as the evaluation results into its virtual counterpart. The CAD system 
serves as a user interface through which the data sets are loaded and the evaluation 
results visualised. Figure 4.46 illustrates a conceptual example of the visualisation 
concept applied to a piezoelectric force sensor in the upper truss of the MAFDS, 
see Sect. 4.2.3. In case of any decision-making process where conflicting data could 
occur, this information helps engineers to identify uncertainty, upcoming conflicts 
and to limit the selection of valid sensors to be considered in the process. The devel- 
oped prototype supports the identifying of the trustworthiness level and the interpre- 
tation of sensor data. 
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Abstract Uncertainty affects all phases of the product life cycle of technical sys- 
tems, from design and production to their usage, even beyond the phase boundaries. 
Its identification, analysis and representation are discussed in the previous chapter. 
Based on the gained knowledge, our specific approach on mastering uncertainty can 
be applied. These approaches follow common strategies that are described in the 
subsequent chapter, but require individual methods and technologies. In this chapter, 
first legal and technical aspects for mastering uncertainty are discussed. Then, tech- 
niques for product design of technical systems under uncertainty are presented. The 
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propagation of uncertainty is analysed for particular examples of process chains. 
Finally, semi-active and active technical systems and their relation to uncertainty are 
discussed. 


The first Chapters of this book provide the conceptual basis for mastering uncertainty 
in design, production and usage of load-bearing structures in mechanical engineer- 
ing. This forms the fundamental floor of our house, presented in Chap. 1. Besides the 
presentation of our motivation, Chap. | reflects on the source and quality of models, 
as well as on data and the term “structures”. Chapter 2 provides a consistent clas- 
sification and definition of uncertainty. This is essential for our specific approach 
on mastering uncertainty, which is described in Chap.3, making use of three exem- 
plary technical systems, which are introduced in Sect. 3.6. On the middle floor of the 
framework of mastering uncertainty, presented in Fig. 1.12, we discuss methods for 
analysis, quantification and evaluation of uncertainty in Chap. 4 and now introduce 
methods and technologies to apply our approach to technical systems. 

Therefore, we first cover the technical and legal requirements for mastering uncer- 
tainty with a focus on product safety and liability in Sect.5.1. Although legal uncer- 
tainty usually expresses itself during product usage, it has to be considered from the 
very beginning of the product life cycle during design and production. The technical 
specification of products, which has to define the technical requirements on the prod- 
uct, effects the uncertainty in an early stage of the development process. From a legal 
perspective, two points are important: firstly, to meet product safety requirements, 
sufficient knowledge of the legal framework regarding the specific application must 
be available; this might be challenging, especially for new developments; secondly, 
liability risks have to be minimised during the design and production phase. 

In Sect. 5.2, we propose several methods to uncover and master uncertainty dur- 
ing the design phase. Therefore, we first introduce a method for the estimation of 
uncertainty occurring during the whole product life cycle, and a generic process 
model used to uncover uncertainty in production or application processes. Further- 
more, uncertainty arising from models which are indispensable for product design, 
is discussed, and different ways to deal with it are presented. Our specific approach 
to master uncertainty in the product development process is presented using our our 
three demonstrator systems Modular Active Spring-Damper System, see Sect. 3.6.1, 
Active Air Spring, see Sect. 3.6.2, and 3D Servo Press, see Sect. 3.6.3. 

The production phase usually takes place in the form of a process chain. Each 
single process, as well as the material passing through the process chain, is subject to 
uncertainty. The uncertainty is propagated through the process chain, see Sect. 3.2. 
In Sect.5.3 we give examples on how to master this propagation of uncertainty in 
process chains. 

Section5.4 deals with methods and technologies to manipulate single processes 
and their application on both the production and usage phase. Based on the defini- 
tion of semi-active and active processes, which is given in Sect.3.3, we cover the 
manipulation of production processes using innovative components. Furthermore, 
we present several semi-active and active technologies to master uncertainty within 
the usage phase. 


5 Methods and Technologies for Mastering Uncertainty 211 


5.1 Technical and Legal Requirements for Mastering 
Uncertainty 


Peter Groche and Laura Joggerst 


Defining requirements in order to master uncertainty is the main goal ofthe following 
section. Both, technical and legal requirements may be established. Regarding the 
product phases design (A), production (B) and usage (C) presented in Fig. 1.3 legal 
uncertainty usually manifests itself during the usage phase, if the product causes 
damage. Ideally, legal requirements influence technical requirements and are already 
considered during the design and production phase of the product in order to achieve 
the highest possible certainty regarding legal liability of producers. The economic 
impact of legal requirements can be derived from the legal framework. We will focus 
on product safety and product liability. In the following, we understand product 
development as the totality of all steps leading to a marketable product, including 
design and production. 

In Sect. 1.6 product design was discussed as a constrained optimisation problem, 
where the objective function has three challenging aspects, namely (i) minimal effort, 
(ii) maximal availability and (iii) maximal acceptability. Conformity with product 
liability is the formal aspect of acceptance. 

The process of defining specifications in engineering design can be understood 
as a socio-technical system, whereby the functionality and quality of a product are 
the result of a complex and dynamic interaction of different stakeholder groups. In 
Sect.5.1.1, we examine this process of how specifications are formulated. Further- 
more, we consider the way specifications are used in product development. Therefore, 
a classification of specifications into objectives and constraints is introduced. 

From the technical perspective, defining a precise and complete technical speci- 
fication is the basis for the subsequent development process of any new product. In 
classical engineering design, uncertainty in the use of the product can derive from the 
misinterpretation of product requirements during product development. This uncer- 
tainty can potentially be addressed at a very early stage of the development process. 
We will discuss the general problem of specification uncertainty, as well as the 
impact technical specifications may have on the overall uncertainty of a complex 
load-bearing system in Sect. 5.1.2. 

In order to clarify product requirements from a legal perspective, we need to apply 
the abstract knowledge of the legal framework to specific applications. Combining 
legal expertise with the fields of engineering and mathematics allows a more user- 
oriented approach to discuss the problem of legal uncertainty where it occurs. 

Therefore, product safety requirements and the importance of technical standards 
will be addressed in order to prevent cost-intensive product recalls. For innovative 
products in particular, the problem arises that producers may not rely on technical 
standards in their development process, as such standards do not yet exist. The ques- 
tion, how producers should cope with this uncertainty is also part of our discussion 
in Sect. 5.1.3. 
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From a product liability perspective, many liability-causing legal risks can be 
avoided in the design of the product and during the organisation of the production 
process. We take an application-oriented approach to answer the question, which 
measures the producer needs to implement in order to minimise liability risks. The 
specific requirements for producers using algorithmic optimisation techniques in 
product development (Sect. 5.1.5) are of a different nature than the requirements for 
producers implementing an autonomous production process (Sect.5.1.4). In both 
cases, the difficult question arises, how liability risks can be minimised, when using 
innovative development techniques or production methods. 

Technical standards, although not always legally binding, are often the basis of 
contracts when selling products. Compliance with standards is therefore a require- 
ment for products. However, technical standards must apply to many different occa- 
sions, and the language used is therefore ambiguous. In Sect.5.1.6, an information 
system is proposed that detects semantic uncertainty in standards and provides sug- 
gestions to the users of standards to resolve the uncertainty. 

Uncertainty does not only affect product development, but planning processes in 
general. In the scientific discipline of project management, concepts, methods and 
practices for dealing with uncertainty have been developed during the last decades. 
In Sect. 5.1.7, we reflect on these approaches from a historical perspective in order 
to provide a better understanding of current tools for planning processes. 

In addition to the general technical methods for mastering uncertainty, we hope 
to provide another dimension to the tools which are discussed in Sect. 3.3. 


5.1.1 ‘Just Good Enough’ Versus ‘as Good as It Gets’: 
Negotiating Specifications in a Conflict of Interest 
of the Stakeholders 


Peter F. Pelz, Michaela LeStakova, Kevin T. Logan, and Tim M. Müller 


Technical specifications provide requirements of the product or services that are con- 
sidered in the design process and are discussed, quantified and checked by the stake- 
holders involved. In classical engineering design, they are supposed to be defined 
at the beginning of the product lifecycle. This classic approach dating back to Pahl 
and Beitz [215] and being the fundament of the guideline VDI 2221 [271] is related 
to uncertainty for two reasons. Firstly, at the beginning of the engineering design 
process, various ways of using and misusing the product have to be anticipated. Sec- 
ondly, in retrospect of every engineering design process, the product functionality 
and quality can be seen as a result of a complex and dynamic interaction of the 
three stakeholders (1) supplier, (2) customer, (3) society. For us the supplier is in 
most cases identical with the manufacturer. There are several strategies known for 
mastering this uncertainty, such as user-centred design, requirement management 
and agile project management. A review of these methods exceeds the scope of this 
section. Instead, the following pages embody a reflection on how specifications are 
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used as a design method in the context of Sustainable Systems Design (SSD) and of 
mathematical optimisation. Moreover, it outlines the process of how specifications 
are formulated by the three stakeholders mentioned above. 


Classification of specifications into objectives and constraints 


In SSD, see Sect. 1.6, Figs. 1.9 and 1.10, a constrained optimisation problem in the 
form of “maximise quality subject to functionality” is solved in the design process. 
Quality corresponds to the objectives and the functionality to the constraints of the 
optimisation problem. 

The tree diagram in Fig. 5.1 provides a classification into two branches, objectives 
and constraints, which have four specification types in the leaves of the tree. There 
is one objective (a) and three different types of constraints (b), (c), (d): 


(a) quality objective, 

(b) quality constraints, 

(c) functional constraints, 
(d) restricted design space. 


The assignment to constraints and sub-objectives is done by each stakeholder indi- 
vidually even though the same system is addressed as we will see in the following. 
The term “constraints” originates from the field of mathematical optimisation and 
describes the restricted solution space of the optimisation problem. In the context 
of technical specifications, it describes possible restrictions and limitations, but also 
demands and requirements. 


(a) Quality objectives are specified by weighted sub-objectives. Weights are impact- 
specific weighting factors often known as cost factors (e.g. pricing the environ- 
mental impact by C O3 taxation). Also, impact-specific incentives (e.g. financial 
subsidies for improvement) can be used as weights. The sub-objectives are the 
three quality directions minimal effort, maximal availability, maximal accept- 
ability, Sect. 1.6. The three quality directions are in agreement with Taguchi’s 
quality engineering methodology [258]. Taguchi demands that manufacturers 
also consider the effort, i.e. the economic costs and the costs to society, as 
a quality measure. The weighted sub-objectives are approximated by agents 
(humans and/or machines) in an incremental Continuous Improvement Process 
(CIP) controlled by the target and impact-specific weighting factors. Hence, a 
quality objective defines a direction and not the required quality level. 

(b) Quality constraints ensure such required quality level. The advantage of quality 
constraints versus quality objectives is the clear commitment. The disadvantage 
is that constraints are fixed and not optimised. Hence, optimal quality and hence 
sustainability will never be reached by quality constraints. A typical quality 
specification is a cost limit to be reached in a design-to-cost engineering process 
or the setting of a pollution limit. 

(c) Functional constraints are specified on the basis of expressed or anticipated 
customer needs. 
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specifications 
in the context of Sustainable Systems Design, i.e. 
“maximise quality subject to functionality“ (Sec. 1.6) 
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Fig. 5.1 The tree diagram (solid line) classifies system specifications in the context of SSD as 
presented in Sect. 1.6 into objectives and constraints. There are a quality objectives, b quality 
constraints and ¢ functional constraints specified on the basis of named or anticipated customer 
needs. A restriction of the design space d is the third and last constraint 


(d) Restricted design space is given by available technologies, resources, operating 
modes, services. The design space may be extended by innovations or restricted 
by banning technologies, such as demanding carbon-free energy supply. 


Section 1.6 classifies acceptability into informal and formal acceptability. Formal 
acceptability is achieved by ensuring legal conformity or compliance with a contract 
between stakeholders. Hence, formal acceptability is assigned to quality specifica- 
tions in the first place. Informal acceptability is fostered through positive user experi- 
ence or positively perceived functional performance. The quality objective in Robust 
Design is a prominent example as presented in the third case study of Sect. 3.5. But 
how does the process of specifying objectives and constraints work? How are quality 
directions given and assigned to the different stakeholder groups? 
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Product functionality and quality is negotiated in a cybernetic system of the three 
external stakeholder groups (1) supplier, (2) customer, (3) society. Internal stakehold- 
ers, i.e. the employees of a company, are not the primary focus here. To understand 
the basic dynamics and outcome of this negotiating process, the external stakeholders 
can be modelled as agents in a cybernetic control system. The purpose of this section 
is not to provide and evaluate a detailed model, but to illustrate how the boundaries of 
SSD can be extended from an techno-economic system to a socio-technical system, 
see Fig. 5.2. 


Cybernetic stakeholder system 


The values of various parameters relevant in the process of negotiating and for- 
mulating the specifications (quality objectives, quality constraints, ...) in SSD are 
subject to processes that transcend the purely technical system. In order to under- 
stand how specifications are determined, we suggest that the socio-technical system 
can be modelled as a cybernetic system, see Fig. 5.2. We begin by identifying three 
stakeholders that are coupled in a control loop: (1) supplier, (2) customer of products 
and services like owners and operators and (3) society represented by one or several 
governments and non-governmental organisations. 

This concept is now applied to analyse the dynamics of specifications using the 
example of the so called “energy ship”, cf. Ist case study in Sect.3.3. Here, the 
supplier (2) is the ship manufacturer. The customer (1) is the owner and operator of the 
energy ships. The customer follows the Friedman doctrine, “the social responsibility 
of business is to increase profit” [109]. This is reflected in the customer’s quality 
objective: minimising the levelised costs of hydrogen (LCOH). 

Tolerated functional and quality constraints are usually communicated to the sup- 
plier in a feedforward control. For example, quality constraints such as tolerated 
efficiency limits or service life guarantees can be required at the lowest possible 
price, which is a quality objective assigned to the supplier by the customer. How- 
ever, formulating the quality constraints by the customer does not give the supplier 
any incentive to deliver the best possible product, but only to act according to the 
precept “just good enough”. On the one hand, this attitude is welcome in order to 
avoid overachievement. On the other hand, this attitude limits sustainability. Another 
possibility would be to map the quality constraint to a quality objective, i.e. to accept 
a higher price if the component efficiency is higher. This leads to the principle “as 
good as it gets”, which is essential for the development of sustainable products: qual- 
ity objectives are followed in an incremental feed back control strategy as Fig. 5.3 
implies. As discussed in Chap. 1, feed back control is robust with respect to uncer- 
tainty in the controlled systems. In contrast, feed forward control demands models 
of the controlled systems. 

Society has many options for intervening as shown in Figs.5.2 and 5.3. It may 
manipulate weighting factors in the quality objectives resulting in (i) incentivisation, 
i.e. certain technologies or solutions can become incentivised like discounted loans 
for fuel cell technology; (ii) penalisation, i.e. certain technologies or impacts are 
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Fig. 5.2 Cybernetic model of a socio-technical system with three stakeholders: supplier, customer 
and society. Control inputs are the constraint specifications for the three stakeholders of the socio- 
technical system 


penalised for example by fiscal policies like CO, tax; setting limits in the quality 
constraints by (iii) regulation, i.e. legal constraints are introduced to limit impact 
like minimum efficiency levels for fuel cells; or reduce the design space leading to 
(iv) restriction, i.e. the use of a certain technology is restricted like banning Diesel 
engines, which leads to an increased use of hydrogen and more profitability for the 
customer. This concerns both the customer and the supplier. As there is constant inter- 
action, the respective specifications are negotiated in the market and they influence 
all stakeholders. 

This classification is not strict and absolute. For example, companies can volun- 
tarily overfulfil the normative requirements of the government, which is done in the 
context of Corporate Social Responsibility (CSR), and thus deviate from the Fried- 
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Sustainable Systems Design (Fig. 1.10) 
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Fig. 5.3 Socio-technical system with the several competing techno-economic systems in its core 
and the three stakeholder groups supplier, customers, society as human controllers and sensors 


man doctrine [212]. However, this unnecessary over-fulfilment of quality constraints 
can lead to an increased reputation in turn, increased profit and thus improve the 
quality objective—maximise profit — of the company [212]. Companies of the Value 
Balancing Alliance [267], founded by BASF SE, Deutsche Bank, SAP and other 
companies in 2019, go one step further by defining the impact specific cost and the 
positive impact of their actions themselves. The high level of uncertainty provides 
scope for interpretation and raises the suspicion of greenwashing [251]. In the per- 
spective of the presented model, the responsibilities of the stakeholders are mixed 
up, which can cause unintended dynamics. This is why transparent and measurable 
Key Performance Indicators for the impact are necessary. 
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It has been shown that specifications can be grouped into four categories: quality 
objectives, quality constraints, functional constraints and restrictions of the design 
space. To understand the process of establishing specifications in socio-technical 
systems, we interpreted the system from a cybernetic point of view. The analysis 
shows that the wide range of stakeholders generates further sources of uncertainty 
in the specification, which are located outside of the product design itself. This must 
be taken into account and adequately modelled, especially when anticipating future 
developments as done in feed forward control. Compliance with the Friedman doc- 
trine, which has been dominant in the past two decades, has failed with regard to the 
development of sustainable socio-technical systems. Both suppliers and customers 
have to adopt the functional constraints of the other stakeholders as quality objec- 
tives. Only the clear commitment to this and making the design process transparent do 
enable sustainable socio-technical systems in the future. To shift the paradigm from 
“just good enough” to “as good as it gets”, the CIP, a well-known tool in business 
management, can be used. 


5.1.2 Technical Specification 
Daniel Martin, Hermann Kloberdanz, and Peter Groche 


Uncertainty occurs in load-bearing systems in all phases of their virtual and real 
product life cycle, cf. Chap. 1. Especially, the development of new products is asso- 
ciated with particularly high uncertainty [216]. One important source for uncertainty 
is the technical specification of products, which is discussed in the following. 

Uncertainty in product development can only be mastered in the long term, if it is 
given equal consideration to technical, economic and ecological requirements from 
the very first beginning. Correspondingly, reliable information from the technical 
specification supports decisions with far-reaching consequences in the development 
process. 

New product ideas are often described by prospective users based on the intended 
application process or their contribution to the functionality of an overall system. 
However, the description of new product ideas is usually very imprecise. Thus, at 
the beginning of the development process, developers have to define the product 
properties in such a way that the resulting products are equipped with the desired 
properties in the use phase, cf. [224, 225]. 

The development task is analysed and detailed with regard to functionality and 
quality, effort, availability and acceptance, cf. Sect. 1.6. Usually, the development 
task is formally described in the form of requirements; and it is summarised in 
a document for the entire development team. The formal documentation is called 
technical specification. The document is frequently referred to as a requirements list, 
specification sheet, product concept catalogue or similar [69]. 
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Although the technical solution is still largely unknown in the design phase, e.g. 
load assumptions must be made, product functions and basic dimensions have to be 
defined, as well as restrictions, e.g. with respect to costs and dimensions. Product 
development teams then use the technical specification during the entire development 
process as an information storage and decision basis. 

The technical specification contributes to mastering of uncertainty in the devel- 
opment process by (i) defining requirements which are subject to uncertainty and 
(ii) directly specifying the requirements of the system in later use including foreseen 
uncertainties. Both contributions lead to a reduced modelling uncertainty. 

The complete and detailed specification of the functional requirements helps prod- 
uct developers to reduce uncertainty during the creation of technical solutions. The 
completeness of the technical specification avoids that important functionalities are 
overlooked, whereas the sufficient level of detail prevents misinterpretations during 
product development. Both reduce model uncertainty, see Sect.2.2, and structural 
uncertainty, see Sect. 2.3, in the development process, as well as uncertainty regarding 
the expectations of product use. 

The models we have developed for the identification, classification and eval- 
uation of uncertainty help designers to foresee influences relevant to uncertainty 
and to quantify an acceptable level of uncertainty, especially in product use. These 
can be formulated and documented as requirements in the technical specification. 
With the methods we have developed to master uncertainty in product development, 
uncertainty in life cycle processes can be predicted and the specified uncertainty 
requirements are met during product development. 


Mastering uncertainty due to modelling 


The development of new products is characterised by gradually more detailed models, 
such as functional structures, effect relationships, embodiment designs and geometry 
representations. The developers create these models based on assumptions, e.g. for 
loads, performance and available assembly space. These assumptions are based on 
information that is documented in the technical specification. Thus, the guidelines 
we developed to reduce modelling uncertainty [283] also serve as a guide to reduce 
uncertainty through the technical specification. 

We exemplify the role of technical specifications by the development of a new 
bearing concept, presented in Sect.5.4.2. The bearing is used as a key element in 
the challenging development of the 3D Servo Press, enabling a force of 1600KN, 
see Sect.3.6.3. It consists of a combination of roller and plain bearings. The use 
of bearings in such a special application leads to uncertainty in the development 
process, due to the complex load and installation conditions. 

The choice of an appropriate and meaningful generic model for a development 
step is supported in particular by the most detailed possible documentation of critical 
system states and load cases. 

For the description of the bearing function we use the model according to Hol- 
land [158], described in Sect. 5.4.2, which was adapted to the mode of operation of the 
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combined bearing concept [247]. The model assumes a force equilibrium between 
the operating force Fop, the plain bearing force Fpp and the roller bearing forces Fiw. 
The plain bearing force Fp» is based on a pressure build-up in the lubricant, which 
depends on the dynamic viscosity 7 of the lubricant, which is supplied with pressure 
Pin and volume flow Qin, as well as the speeds of the shaft, @snart, and bearing shell, 
@sheil, and the position of the shaft inside the bearing shell. 

For common plain bearing designs, a quasi-static load condition of the rotating 
shaft by a constant load is assumed. In this case, the rotation speeds of shaft and 
bearing shell cause a non-constant pressure distribution prot in the circumferential 
direction due to the radial shaft displacement e. However, the detailed specification 
of the force curve over the angle of rotation, which occurs in mechanical presses, 
indicates that a significant temporal change of the shaft displacement occurs due to 
a force peak at the operating point. This leads to an additional pressure build-up Psq 
in the area of the minimal bearing gap Amin, which is not covered by the lubrication 
model for steady operation. The resulting forces on the shaft can be expressed by the 
Sommerfeld numbers for rotation, Sorot, and squeezing, S0sq, 


Fo Y? 
bdn |osnart + Oshen — 28 


tae 
~ bdné 


SOrot = and = Sq 


Here, ö describes the position of the minimal bearing gap in polar coordinates while 
& is the squeezing rate. The consideration of these two forces in the model is of deci- 
sive importance for the specific application. In Sect. 4.3.5 we have seen how large the 
effects of model uncertainty on the results can be when a model is applied inappro- 
priately because of ignorance. Initiated by the specification of the force curve over 
the shaft’s angle of rotation, which varies considerably over time, the development 
of the combined roller and plain bearing system of the 3D Servo Press was based on 
the assumption that, in addition to the hydrodynamic effect, a displacement of the 
oil must be taken into account when designing the plain bearing. Since the relevant 
load conditions are thus recorded much more accurately, the uncertainty of the press 
development could be significantly reduced by the choice of the model. 

In general, when specialising a generic model for the current development task, 
e.g. a functional structure, the developers define an appropriate system boundary and 
granularity of the model. The system boundary represents the part of reality that is 
considered as relevant. The granularity results from the scope and thus the number 
of components for modelling the system, see Sect. 1.3. 

The technical specification influences uncertainty in modelling the system by 
information that acts as a basis for assumptions and decisions of the developers. In 
particular, detailed requirements regarding load assumptions, disturbance variables, 
resources and boundary conditions enable the developer to choose a model hori- 
zon that takes into account essential uncertainty-critical influencing parameters. The 
identification of critical uncertainty in the technical specification supports the defini- 
tion of relevant components with adequate complexity. This ensures the conciseness 
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of the model as a very important model feature and a prerequisite for successful 
product design. 

We use the specification of the viscosity range of the system element lubricant 
which is a part of the roller and plain bearing as an example. The combined roller 
and plain bearing system is exposed to high loads. Due to its significant influence 
the temperature dependence of the dynamic lubricant viscosity 7 must be taken into 
account. 

Another example concerning the adequate mapping of the combined roller plain 
bearing system in a model is the deviation of the assumed loading situation. A possible 
deviation from assumed conditions is given by an inclination of the operating load 
caused by uncertainty outside the system boundary of the combined bearing. The 
behaviour of the combined bearing under such disturbing influences is investigated 
in [132]. 

The force conduction through the roller bearings is calculated by means of 
Fp = Cwe with cm representing the stiffness of the rolling elements, neglecting 
elastic deformations of the shaft and the plain bearing shell. 

This example shows that neglecting insignificant influences contributes to sim- 
plifying models and improving their conciseness. The differentiation and detailing 
of critical requirements urges developers to decide explicitly on the admissibility 
of simplifying assumptions that affect particularly critical system properties, see 
Sect. 4.3. 

In the example of the combined bearing system, the dependencies of viscosity on 
pressure and temperature were recognised by references in the technical specification, 
but the uncertainty by neglecting these dependencies was assumed to be acceptable. 

In summary, it can be stated that the modelling of the system is based on the 
information of the technical specification. The technical specification supports the 
developers in making relevant assumptions and to work out appropriate system mod- 
els by specific documentation of critical functional requirements. Thus, it can reduce 
the influence of uncertainty. Model uncertainty can be effectively controlled by incor- 
porating all relevant system areas and system properties into the development process 
to optimally meet customer expectations, despite the simplification of reality. 


Mastering uncertainty due to requirements 


As shown in Sect. 1.6, informal acceptance can represent the fulfilment of customer 
expectations, which has a significant influence on the success of the product. As 
described there, a high level of acceptance is achieved by reducing effort and increas- 
ing availability. In order to ensure a high level of availability in product development, 
product developers detail this objective right from the start in the form of require- 
ments that are as precise as possible or even quantified. They document these require- 
ments in the technical specification as a basis for decision-making during product 
development. 

However, the quantification of availability depends strongly on product usage and 
is not always possible, as already stated in Sect. 1.6. The models and methods we 
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have developed for the identification, evaluation and quantification of uncertainty and 
uncertainty influences allow in these cases the indirect specification of availability 
requirements without the technical solutions being known. 

The type of the product to be developed and its conditions of use determine 
the scope and description of the uncertainty that must be taken into account in the 
development. Depending on the degree of uncertainty these are documented in the 
technical specification in the form of requirements regarding reliability or robustness 
properties. 

Systems and machines for stationary use in production are usually operated in 
factory buildings with largely determined environmental and process conditions. 
The reliability specification defines “the probability that the required function of 
a product will not fail during a defined period of time and under given working 
conditions” [143]. Reliability is indicated in the technical specification by perfor- 
mance indicators such as Mean Time Between Failure (MTBF), Mean Time To Repair 
(MTTR), Uptime or Production Yield. Reliability is therefore based on the assump- 
tion that the causes of uncertainty are largely known and vary only slightly. The 
specification must therefore ensure that disturbance influences are defined or elimi- 
nated during the operation of the systems. 

When developing robust systems, information regarding uncertainty causes in the 
specification are a prerequisite to guarantee a high availability in use, cf. [192]. 

In our case of highly loaded roller bearings, lubrication must be ensured so that the 
calculated service life and frictional torques (and thus power loss) are achieved during 
operation. Regarding the combined roller and plain bearing presented in Sect. 5.4.2, 
the volume flow Qp» of the lubricant exiting the plain bearing in the axial direction 
serves to lubricate the roller bearings. However, this coupling of the lubricant flows of 
the plain bearing and the rolling bearings has a considerable influence on the system 
behaviour and must therefore be taken into account in the development. However, on 
the one hand, the lubricant properties are predetermined by the design of the plain 
bearing and, on the other hand, the lubricant temperature and the lubricant flow vary 
depending on the operating conditions of the plain bearing. The developer can only 
master the undefined lubrication conditions by a robust design of the rolling bearing. 
A prerequisite for mastering the uncertainty in the robust design of roller bearings 
is therefore comprehensive information on the properties of the lubricant and the 
lubricant flow in the technical specification. 


Conclusion 


In a nutshell, during the development of new products, developers may significantly 
influence the uncertainty of the product to be developed with the technical specifica- 
tion. The specified properties of the system can have an indirect or direct influence. 

Mainly the complete coverage of causes of uncertainty contributes to mastering 
uncertainty in the product development process. A mostly complete specification of 
functionality and uncertainty influences can reduce model uncertainty and indirectly 
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enhance correct predictions and availability of the system and thus the informal 
acceptance. 

Uncertainty can be directly reduced if uncertainty effects from and on the system 
environment are captured and specified comprehensively and as detailed as possible, 
preferably quantitatively. The checklists of the robust design methods of the early 
phases of product development can be particularly helpful in this respect. 

Elaborating the technical specification, it is purposeful to anticipate development 
steps and to support the developers in making assumptions by specific information 
structured according to model characteristics, cf. [283]. 


5.1.3 Product Safety Requirements for Innovative Products 
Laura Joggerst and Janine Wendt 


Product recalls, as discussed in Sect. 1.1, are expensive and harmful to the producer’s 
image and therefore should be avoided. Although product recalls become relevant 
in the usage phase of a product, the root cause often traces back to the design and 
production phase. Figure 1.3 presents an overview of the three product phases and 
how they are linked. But product recalls are only necessary for products that can be 
dangerous, i.e. they present potential risks to the body, health or life of consumers, 
users or third parties in general. Reasons for recalls can be manifold. For example, 
in certain sectors, the product quality decreases due to economic factors and strong 
competition [278, p. 62]. 

But another reason for product quality not complying with product safety require- 
ments can be, that the requirements are becoming more and more diverse and com- 
plex, Sect. 1.1. Or even the fact that no technical standards are applicable to new and 
innovative products. 

If a product is in use and it turns out that it poses a safety issue, it needs to be 
taken off the market. Legal product safety is this strict due to its preventive character. 
Its aim is to ensure that only safe products are in use and on the market. Together 
with product liability, product safety requirements provide full protection of the 
consumers’ legally protected rights. In this subsection we aim at clarifying what is 
required for the producer to prove the safety of his product. 


Product safety 


The Product Safety Act is the main legal framework for product safety in Germany. 
It is accompanied by numerous technical standards, which specify requirements for 
the practical application [173, marg. 2]. Furthermore, it is subject to European reg- 
ulation, which is why many of the technical standards are developed by European 
Standardisation Organisations. Basically, two groups of products need to be dis- 
tinguished. Those which fall into the category of harmonised products and those 
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which do not. In the case of harmonised products, the producer compulsorily needs 
to comply with the provisions, applicable for the specific case. These provisions are 
mostly based on European Standards. If the product complies with said provisions, 
it is assumed to be safe and can therefore be placed on the market [195, marg. 3]. 
National provisions for harmonised products often only regulate a minimum of safety 
which the product has to achieve. They are often accompanied by industry standards 
which are more detailed but not obligatory since they lack legal quality [66, p. 42]; 
[117, p. 1492]. In the case of non-harmonised products, the producer can exclusively 
follow national standards. Similarly to harmonised products, the compliance with 
these standards implies their safety. But, the application of these technical standards 
is not mandatory. Nevertheless, producers need to prove the compliance of the prod- 
uct with safety standards set by the national provision and technical standards, as 
well as state-of-the-art technology. On the contrary, the non-compliance with said 
standards does not automatically imply that the product is unsafe. Unsafe products 
are rather those which pose a potential risk to the legal rights the Product Safety Act 
aims to protect namely a person’s health, body and life. 

The Product Safety Act is the hurdle which anyone placing a non-food product 
on the market for the first time needs to clear. At the same time the product needs to 
be made available on the market for commercial use. Further, the Product Safety Act 
is not only applicable to products, but also to facilities which are deemed hazardous 
and thus require monitoring and inspection. For this discussion, we will solely focus 
on products. 


Market surveillance 


In cases of non-compliance with the safety requirements set by provisions and tech- 
nical standards, Market Surveillance Authorities can direct producers to different 
behaviour in order to avert danger for consumers, due to the respective product. 
These measures may consist of requesting the producer to take action in order to 
end the risk accompanied with the product. They can also prohibit the further dis- 
tribution of the product, or, in particularly risky cases, even demand the product to 
be recalled. Any of the mentioned measures are likely to have a negative impact on 
the producer’s reputation and are certain to cost money. Therefore, the objective is 
to avoid authority intervention at all times. 


RAPEX 


The so-called RAPEX-System (Rapid exchange of Information) enables both mem- 
ber states and the European Commission to exchange information on dangerous 
products which are on the European market, but are being taken off the market, or 
are part of a product recall. 
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In addition, the RAPEX-System determines the level of risk of a product [174, 
p. 38]. Producers need to apply this assessment system to their product. The level of 
risk also determines possible measures taken by the market surveillance authorities. 


Technical standards and the proof of safety 


Technical standards are developed by private institutions, which collect knowledge 
from industry standards and compile it into one comprehensive document. These 
standards are more user-friendly than the requirements set by legal provisions, since 
they can have a very specific scope of application. Furthermore, legal provisions 
are vaguer in order to be applicable to a wide variety of use cases. As mentioned 
before, technical standards concerning non-harmonised products have no legally 
binding character, as they do not undergo a legislative procedure. Nevertheless, they 
represent the state-of-the-art technology. Therefore, when the producer designs a 
product following the technical standards, it implies that the product complies with 
the current minimum safety standard existing in the industry. As a result, the product 
is deemed to be safe and can be distributed on the market. 


Non-compliance with existing technical standards 


If producers do not comply with existing and applicable technical standards, this 
does not per se indicate that the product is unsafe [165, p. 722]. The reasons for this 
non-compliance can vary. The producer could just have overlooked the existence of 
the technical standard or he could have consciously neglected it. The reason behind 
this could be that the producer found a better, easier or cheaper option to provide the 
same level of safety of the product with a different construction than recommended 
by the technical standard. Therefore, it is necessary for the producer to prove that 
the minimum safety, set by the technical standards applicable, is met otherwise. 


Missing technical standards 


Another problem arises, if no technical standards are available to the producer when 
designing the product. This can be the case for innovative products, when no clear 
industry standard has been developed, yet. Without technical standards, there is no 
implication for the safety of the product in terms of the Product Safety Act [117, 
p. 1493]. So, how can the safety of the product be determined? This question is 
particularly important for the producer, as the product cannot be marketed without 
the positive safety implication. 

In most cases, it is neither practical nor possible to apply technical standards 
developed for a different scope of application to another product, even ifthe products 
are similar [213]. 
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It becomes apparent that the effort for providing proof of the safety of the product 
is much higher than in the case of existing technical standards. The producer must 
apply some kind of risk analysis to prove the safety of the product. But no official 
guidelines exist for how this analysis should be executed and what information needs 
to be taken into account. This uncertainty increases the efforts of the producer to 
provide the necessary proof of safety even more. 

Practical guidelines would help the producer to do what is expected. This would 
equally make products safer compared to the case where a producer sets his or her 
own standards to prove the safety of any innovative product. German jurisdiction only 
offers guidance, as it was decided that sampling inspections are not a permissible 
basis for providing proof of the product series as a whole [213]. 


Machinery directive 


The Machinery Directive [97] also demands a risk analysis and gives guidance as to 
which aspects the producer needs to consider during the analysis. For example, the 
producer needs to consider the intended use in addition to the foreseeable misuse of 
the product and determine the limits of the product. In the case of the Machinery 
Directive, the product is a machine and the Directive only applicable to such. Addi- 
tionally, the producer needs to identify potential hazards and dangerous situations 
caused by the machine. Just by mentioning these requirements, it becomes clear that 
the risk analysis described by the Machinery Directive is not very specific and does 
not include specifications on how the information to evaluate said aspects should be 
gained. 


Product safety and market surveillance package 


The requirements stated in Article 8 of the Proposal for a Product Safety and Market 
Surveillance Package [96] are similarly vague. In this proposal, technical documen- 
tation for the product is required and should contain, amongst others, an analysis 
of the possible risks related to the product. But again, it contains no guidance as to 
which information is relevant for the analysis. 


Non-legislative guidelines 


The decision of the European Commission concerning the RAPEX-Guidelines [95] is 
a non-legislative and therefore non-binding document. But other than the mentioned 
legislative acts, this guideline provides useful information on how to perform a risk 
analysis for products and recommends a three-part assessment. 

The foundation of this assessment is to describe the product and the inherent 
danger as well as identifying the group of potential users. Regarding this, intended, 
as well as unintended users need to be considered. Potential users should also be 
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categorised according to their vulnerability. For instance, children and elderly people 
are vulnerable users in most cases. But depending on the use case or type of product 
usually not particularly vulnerable users might become vulnerable, for example, if 
warnings and instructions on the product are written in a foreign language. If different 
types of users can be identified, the risk assessment might have to be performed for 
different scenarios considering the different users in order to identify the highest 
risk combination. For the actual risk analysis, the producer should first anticipate 
a situation in which the product inherent risk manifests itself by injuring a person. 
This scenario will mostly revolve around the potential defect the product can have 
during its lifetime. This defect then causes the injury of a user or person, who comes 
into contact with the product. 

Furthermore, it is significant for the assessment of how severe the anticipated 
injury would be. According to the RAPEX-Guideline, factors for the evaluation can 
be the duration the hazard of the product has on the potential victim, the body part 
which would potentially be injured and the impact on the respective body part. For 
example, losing a finger is a much more severe injury than lightly burning the skin 
on one finger. The severity of the injury can then be used as an indicator for the level 
of danger the product poses and vice-versa. In case different scenarios are possible, 
the one causing the severest injury should be considered first, as preventing this 
scenario provides the greatest safety for potential users. The second step would be to 
determine the probability of the scenario and therefore the probability of the person 
getting injured due to the hazardousness of the product. The RAPEX-Guideline 
recommends separating the anticipated scenario into smaller steps, identifying the 
probability of each individual step and then multiplying the individual probabilities 
to receive the overall probability of the scenario. 

Lastly the RAPEX-Guideline recommends that the producer should combine the 
two steps, joining hazardousness and probability to obtain the risk of the product. Four 
risk categories are intended: serious, high, medium and low. Figure 5.4 demonstrates 
the combination of the probability of the injury, the severity of the expected injury, 
as well as the impact on the risk classification. Depending on the risk category, it is 
expected of the producer to apply a suitable effort to prevent the calculated risk. The 
higher the risk, the more important it is to mention that the whole process behind 
the described risk analysis should be documented, in particular in the case market 
surveillance authorities request this information. Figure5.5 provides a simplified 
overview of the recommended procedure. 

Finally, the recommended sources of information for all the consideration above 
are accident statistics, knowledge gained from previous and similar products, as well 
as experts’ opinions. As the problem discussed regards the question of how produc- 
ers of innovative products can provide proof for the safety of their product in case 
no technical standards exist, it is highly likely that neither knowledge nor accident 
statistics exist that would be applicable to the product in question. Therefore, pro- 
ducers should base their assessments on information gained from experts’ opinions 
but not without checking the obtained information for plausibility. 
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Fig. 5.4 Risk level from the combination of the severity of injury and probability derived from 
RAPEX-Guideline [95], Table 4 
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Conclusion 


We conclude that technical standards are a useful tool for mastering uncertainty. 
Compliance with these standards implies that the minimum safety requirements are 
met and that the product is safe enough to be distributed on the market. In some 
cases of new technology, technical standards do not exist and therefore no guidance 
is available to the producer. As a result, the producer must provide proof of the safety 
of his product in other ways. As no legally binding documents exist, we found that 
following the risk assessment described in the RAPEX-Guideline is currently the 
safest way for the producer to demonstrate the safety of his product. 
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5.1.4 Legal Uncertainty and Autonomous Manufacturing 
Processes 


Laura Joggerst, Janine Wendt, and Peter Groche 


In the future of manufacturing more and more autonomous systems will be imple- 
mented to raise product quality and product safety. But first and foremost, they 
are implemented to make production processes more cost- and material-efficient. 
Although fully autonomously acting manufacturing processes are still to come, the 
discussion of relevant legal issues is very present. Without autonomous manufactur- 
ing processes on the market, there can be no jurisdiction to base legal requirements 
on. Uncertainty regarding legal requirements and legal risks can be one reason for 
the stagnation of innovation. The general issue and characterisation of uncertainty 
is discussed in Chap. 2. If the legal requirements that manufacturers must comply 
with could be specified today, innovation could be promoted and guided in the right 
direction. This tool for mastering legal uncertainty accompanies the methods for 
mastering uncertainty in a general technical sense as discussed in Sect. 3.3. 

Legal literature often discusses, whether or not our existing liability regime is 
applicable to new and innovative technology [285]. This question arises because the 
current legal liability framework was established during a time way before automated 
processes were thinkable. Without going into more detail, it can be stated, that the 
current liability regime has such a broad spectrum that even autonomous systems 
generally fall into its scope. It goes without saying that some alterations will have to 
be made to the way we interpret regulations. Without these alterations, liability gaps 
can occur. 

For the sake of a liability regime that is well suited for the innovative technology 
to come, and provides guidance as to what is legally expected from innovators and 
producers, this interpretation needs to take a practical approach. What are the specific 
problems that occur, when using, e.g. autonomous production processes, and how 
do we interpret the existing liability regime accordingly? Regarding liability risks 
in manufacturing processes, both conventional and autonomous, we are concerned 
with two main rules: Sect. 1 paragraph 1 of the Product Liability Act and Sect. 823 
paragraph 1 of the German Civil Code. Contracts between the parties can also result 
in compensation, if they are violated. In the context of this discussion, however, 
we will exclusively focus on the aforementioned rules. Firstly, this is so because 
contracts are only binding between the parties resulting in the risk of uncertainty 
being much lower. Secondly, because the real legal uncertainty lies in the liability 
for damages inflicted on users and third parties. 


Section 823 paragraph 1 of the german civil code 


Section 823 paragraph 1 of the German Civil Code applies to damages done to life, 
body, health and property of a person. It is the key rule of German tort law. Manu- 
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facturers’ liability is only one facet of this rule, for a historical account see [36]. Its 
broad scope applies to many different actions causing the damages mentioned above. 
The first requirement of this rule to be applicable is that damage is done to one of the 
protected rights. Secondly, the damage must be caused by an intentional or negligent 
action. Finally, this action needs to be unlawful, meaning, not complying with the 
general principles of the law. Assuming that, in most cases, the manufacturer does 
not intend to harm another person’s rights, which is considered to be an intentional 
action, the large number of cases will evolve around the question of how to deter- 
mine negligence. A negligent action is based on the violation of a security obligation. 
Generally, anyone who uses or creates a source of danger to others, needs to ensure 
that no harm is done [37, marg. 10]; [33, marg. 21 f.]. The security requirements that 
derive from this obligation depend on different factors: Potential users, whether they 
are consumers or professionals, intended and unintended but foreseeable use cases, 
which are limited by intentional misuse. All of these criteria need to be taken into 
consideration by the manufacturer. Users’ safety expectations must also be taken 
into account as far as they are reasonable. 

In addition, the product has to comply with the current state-of-the-art safety 
standards. In this context, current refers to the point in time in which the product is 
marketed. German legislation has developed specifications for the safety obligations, 
the manufacturer has to comply with. They can be categorised in the areas of design, 
construction, instruction and monitoring of the product during its use phase. During 
the design phase, the producer is expected to choose the final product design with 
the required safety in mind. At the same time, he needs to document his decisions in 
this respect. In the event of liability claims, the producer needs to prove that no other 
design alternative would have been better suited to prevent the occurred damage [32, 
marg. 16]. 


Product liability act 


For damages done to body, health or property of a person, Sect. 1 paragraph 1 of the 
Product Liability Act is applicable besides the general provisions of tort law. The 
Product Liability Act explicitly addresses producers of defective products. A product 
is defective, if it does not meet the expected safety standard. Safety requirements 
can be established similarly to Sect. 823 paragraph | of the German Civil Code. The 
same categorisation applies, except there is no obligation to monitor the product 
during its use phase. This is due to the fact that the aim of the Product Liability Act 
is to ensure that only safe products are placed on the market. Therefore, its relevance 
ends with the first placement of the product onto the market. Everything past this 
moment can only be regulated by Sect. 823 paragraph 1 of the German Civil Code. 
The main difference between the two provisions is the fact that the liability stated by 
the Product Liability Act is not based on fault, making it more consumer-friendly. 
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For discussion purposes, we are going to evaluate the product liability issues con- 
cerning autonomous production processes referencing an autonomous deep drawing 
process. In order to get a better understanding of the problem, it is necessary to 
evaluate current state-of-the-art closed-loop controlled processes. 

The demands on geometry and ever new materials pose a challenge for conven- 
tional deep drawing processes. The wall thickness of the final part has to be further 
reduced in order to make better use of the material, which increases the risk of wrin- 
kling and cracking [7]. The use of more robust and thinner materials contributes to 
this effect as well. In addition, there are the fluctuations inherent in the process or the 
fluctuations in the material. All of this narrows the process window [168]. The deep 
drawing process consists of different steps, starting with the production of a blank cut 
from supplier coil material, followed by the actual deep drawing step and the qual- 
ity control. The highly automated process has the ability to take data into account, 
which is provided by the supplier of the coil material. Also, the process can forward 
information from each production step to the next. Fluctuations and uncertainty in 
materials and between the individual steps of the process can therefore be taken into 
consideration. Information on the quality of the final product can then be fed back 
to adapt blank holder forces in the deep drawing process. Achieving the maximum 
drawing ratio, as displayed in Fig. 5.6, enables better material utilisation and the deep 
drawing of more complex geometries. Drawing ratio in general refers to the ratio of 
the blank diameter to the punch diameter. In conventional deep drawing processes, 
the maximum drawing ratio is linked to a higher risk of wrinkling or tearing, and 
therefore, to potential failure of the final product. With highly automated processes, 
the desired maximum drawing ratio becomes more achievable without taking higher 
risks. 

Quality control checks random samples for compliance with specified product 
requirements. This is achieved by both optical measurements for the geometrical 
properties and destructive testing for robustness. Further, it is possible to measure 
blank holder forces, draw-in ratio of the blank, as well as wrinkling and tearing with 
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real-time sensors in the tools. However, it is not possible to detect thinning of sheet 
metal or microscopic cracks without destructive testing. Thus, although the process 
can adapt to material fluctuations so that the geometry produced stays constant, 
other material properties that have never been problematic before can fluctuate. These 
undiscovered property fluctuations can have a great impact on the safety of a product, 
e.g. for load-bearing car components, such as car doors. Therefore, products can pass 
optical quality control and still fail during their use. 

State-of-the-art deep drawing processes are based on the control of blank holder 
force in order to prevent wrinkling and tearing. Still, these offline closed-loop pro- 
cesses do not feedback information from the quality control or crash test data. As a 
consequence, the next step in the evolution of the deep drawing process must include 
such a feedback-loop, as well as the ability to adapt to an online closed-loop process. 
This will also involve processes to be able to learn. But while learning from geome- 
try, data alone will prevent wrinkling and tearing, necking for example might be left 
unseen. In addition, the learning process needs to consider strength parameters. Since 
measuring strength has not yet been feasible inline, the measuring effort would be 
high. For the process to learn according to given strength parameters, measurements 
have to be taken frequently, for example every 100 parts. 


Outlook on future autonomous processes 


The autonomous production process will be able to make many relevant decisions 
by itself without human interaction, assuming that there is enough data from the use 
phase and failure of the previous product available. Even decisions concerning the 
design will be made by the process itself, for example choosing the coil material for 
deep drawing. According to the desire to produce more light-weight products, the 
process might decide to use a material that has not been used before, by applying 
the knowledge it has achieved from previous iterations with other materials. Errors 
might occur, if the new material behaves differently, due to the fact that it is more 
brittle, for example. Therefore, microscopic cracks may occur in the final product 
that cannot be detected 100% by optical quality control, yet. Consequently, the 
process could not adapt its production parameters as there is no data base to learn 
from. The process might have to be limited to materials that have already been tested 
before. In this sense, the process could not act fully autonomous. Nevertheless, 
the ability to learn and adapt production parameters for every product counteracts 
material fluctuations as well as fluctuations in tolerances from upstream processes, 
and therefore copes better with many of the uncertainties equally occurring in current 
production processes. 


Discussion 


If products, manufactured by an autonomous production chain, cause harm to a 
person’s rights, the question arises who will take responsibility for the damages 
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done. In most cases both Sect. 823 paragraph 1 of the German Civil Code and Sect. 1 
paragraph 1 of the Product Liability Act apply. The Manufacturer of the product is 
held liable. Section 823 paragraph | of the German Civil Code requires a breach of 
duty of care, whereas liability under the Product Liability Act requires a defective 
product. Therefore, different categories of defects have been established: errors in the 
design, the fabrication, instruction or product monitoring. Errors in fabrication refer 
to deviations between the designed product and the final product after manufacturing. 
But, a 100 % error-free production is not expected of the producer. Therefore, he is 
not held liable for so called outliers in production [35, marg. 12]. For autonomous 
production processes, this category is no longer useful. Therefore, we focus on the 
other categories. 

The interesting, and from a legal perspective, important feature of the autonomous 
production process is its ability to learn. During the deep drawing process, the param- 
eters can be adapted to produce a product with a defined geometry. The process 
decides on the used material, the applied blank holder force and the duration of the 
deep drawing process. All these choices influence not only the geometry of the final 
product, but also its safety, for instance in the event of a crash. Conventionally, these 
choices would be made by the manufacturer, but in autonomous production pro- 
cesses, decisions are transferred to the process itself. Consequently, legal obligations 
concerning the safe product design can no longer be ascribed to a specific choice of 
the manufacturer. In order to identify legal obligations for the use of an autonomous 
production process, we have to consider the production process in its entirety, rather 
than the individual product, for a deeper discussion, also see [163]. 


Use of autonomous production processes 


The first question to answer is whether autonomous production processes should 
be used at all, which is a crucial question for all new technologies that pose new 
risks. In order to give an answer, the interests at stake need to be considered. In an 
autonomous production process, parameters are set automatically during the process 
itself, rather than manually as in conventional production processes after a product 
inspection. Ideally, autonomous production processes minimise the risks of human 
misbehaviour and thus the risk of product failure. 

In reality, there is still a lot of uncertainty, when trying to identify the actual risk of 
a product failure. Along the example of the automated deep drawing process, man- 
ufacturing close to the process limit also poses the risk of material thinning, which 
cannot be detected in a non- destructive way, yet. At the same time, completely new 
failures could occur, which have not been relevant for conventional production pro- 
cesses yet. The manufacturer needs to ensure that the products manufactured by such 
a process are as safe as the current state-of-the-art products [32]. The learning phase 
during the development of the production process needs to produce a steady product 
quality complying with the current state-of-the-art safety standards. Even then, a 
residual risk cannot be eradicated completely. Therefore, manufacturers have to find 
a way to quantify the risks as well as the safety-gain inherent to the autonomous pro- 
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duction process. At which level of residual risk the autonomous production process 
may be used is not clear yet. This depends on the acceptance of such processes in 
the public and political opinion. Nevertheless, setting a standard for the permissible 
risk should not be left to the industry. Instead, clear guidelines should be developed 
by political institutions. 


Obligations during the use of autonomous production processes 


When applying the currently applicable legal framework to the technological innova- 
tion of the autonomous production process, two problems become apparent. Firstly, 
the learning character of the process is based on failure. Learning can only come from 
failure, whereas the legal obligation is based on avoiding such failure. Secondly, the 
functionality of the process is based on software. It is acknowledged that software 
cannot be produced 100% free of errors. Knowing this, the manufacturer needs to 
take particular care in monitoring the functionality of the production process [253, 
p. 3147]. This obligation is conventionally not prioritised from a legal perspective, 
but serves as a compensation for the fact that all relevant design choices are made by 
the process, not the manufacturer. The producer’s obligation to design a safe product 
is therefore less demanding. 

The question then is, how this obligation to monitor the process should be imple- 
mented. It is also worth mentioning that one cannot always conclude the safety of the 
product from the fact that the process functions correctly. As a result, the manufac- 
turer should also identify safety relevant properties of the product and monitor them 
as well. The effort, the manufacturer needs to put into monitoring the process and the 
product depend on how the process learns and adapts. Particularly the frequency of 
a learning impulse is relevant, since the process only changes and adapts the process 
parameters after such impulses. If the process is based on the data of every single 
product, parameters can change after each product. Thus, the manufacturer would 
also have to monitor the safety relevant properties of each product. Whereas, if the 
data of only every hundredth product is used as a learning impulse, a change in the 
process parameters only occurs at this frequency. Then, it would be sufficient to 
check the properties of every hundredth product, i.e. the product after the learning 
impulse. 


Obligations concerning the products of autonomous production processes 


Lastly, the manufacturer has an obligation to monitor the product during its use phase. 
This way, defects that occur after a certain time in combination with other products or 
in general “in the field” can be detected. The information derived from this monitoring 
process is valuable and must be used to either prevent damage to protected legal 
rights or simply as input for future product development processes. The measures 
that need to be taken to monitor the product are manifold and depend on the specific 
product. But in general, it can be stated that the manufacturer needs to implement 
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a complaint management system [103, marg. 379]. In addition to managing this 
passively achieved information, the manufacturer needs to actively inform himself 
about possible defects and errors concerning his product by checking newspapers, 
relevant journals [34, marg. 34], test reports or internet forums [146, p. 2729]. With 
the advancing technological innovation, it could also be possible to monitor products 
in real time. This would pose new legal questions which have to be discussed in the 
future. 


Conclusions 


In summary, autonomous production processes enable different and more efficient 
production ways. The current legal framework adapts to the new production tech- 
nology. Manufacturers need to “train” the autonomous process until reliable results 
are achieved. The residual risks and the safety gained are to be quantified in some 
way. Guidelines to what level of residual risk is permissible should be developed 
by political institutions. When using an autonomous production process, the focus 
must be on monitoring the process and the resulting products during the production 
process, as well as on monitoring the products during the use phase. 


5.1.5 Optimisation Methods and Legal Obligations 
Laura Joggerst and Janine Wendt 


Computer software and hardware have improved so far that using simulation and 
optimisation tools in product development processes has become a common fea- 
ture. These tools allow for more complex designs and larger systems, as well as 
improvement of development time, accuracy and safety. At the same time, optimi- 
sation methods are becoming more and more popular in developing product parts 
or a system topology. A new trend in mathematical optimisation is the treatment of 
resilient systems. Methods for developing resilient systems explicitly take failures 
of components into consideration, trying to guarantee at least a predefined limited 
function of the system itself. Although these methods are highly promising, the 
implementation is very complex and is usually done in the context of data, model 
and structural uncertainty, see Chap. 2. This uncertainty can then result in legal lia- 
bility, if a person’s rights are harmed. In order to minimise legal uncertainty in the 
development process using optimisation methods as well as resilience optimisation 
methods, we need to understand the way these methods work and how their imple- 
mentation affects the legal product development requirements we know. The concept 
and use of resilience for mastering uncertainty is described in Sects. 3.5 and 6.3.1. 
Legal literature usually takes a more abstract approach to discussing the impact 
new technologies and new algorithmic design methods have on the existing legal 
framework. This is why we take a rather technical approach in order to gain a more 
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specific and concrete idea as to how our current liability regime adapts to new algo- 
rithmic design methods. We also want to discuss which legal requirements can be 
derived for producers to comply with, and if and how the current legal framework 
might have to be adapted. 


Legal liability 


As seen in Sect.5.1.4, Sect.823 paragraph 1 of the German Civil Code is the key 
liability rule. In addition to producer liability, the provision generally covers cases 
in which a person is injured, killed, or the person’s property is impaired by a source 
of danger in circulation. The basis of this liability is the violation of a duty of 
care. Anyone who benefits from a dangerous product has to ensure that this product 
does not harm others [28]. In this sense, dangerous products are those, which are 
potentially dangerous for others, simply because of their nature, for example cars. 
The determination of necessary precautions depends on a number of factors. On the 
one hand, it depends on who the potential users are and therefore who is potentially 
at risk. On the other hand, it depends on which dangers can potentially occur. All this 
has to be considered by the manufacturer of a product or the operator of a system. 

It should be emphasised, however, that only what is reasonable can be expected. 
The manufacturer or operator does not have to eliminate every residual risk at every 
price in order to be spared from liability. What can reasonably be expected varies 
from case to case. In principle, however, it can be said that the safety standard set by 
state-of-the-art technology has to be satisfied. On the one hand, the state-of-the-art is 
represented by norms and standards, but on the other hand by the solutions available 
on the market. Still, compliance with the current norms and standards alone does 
not necessarily protect against liability. In some cases, it will rather be necessary 
to take safety measures beyond norms and standards that are available according 
to the state-of-the-art technology. Norms and standards thus form a kind of min- 
imum safety that should not be undercut. Although they are not legally binding, 
non-compliance with them has an indicative effect for non-compliance with safety 
requirements, which would have been possible according to state-of-the-art technol- 
ogy [31, with further references, marg. 16]. 


Resilience 


The anticipation of several possible failures of the system or a product is a promising 
step into trying to make products safer. The idea is to ensure a pre-determined mini- 
mum functionality that the system or the product will still be able to achieve in case 
of disturbance or the malfunctioning of a specific amount of product components. 
Resilience can be implemented in the product development process, for instance by 
only considering design options that achieve the minimum functionality in the event 
of k component failures [9]. The product or system then has a so-called buffering 
capacity of k. For more than k component failures, no reliable outcome can be pre- 
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dicted. This is, in a way, a restriction when designing a product using resilience 
optimisation methods. Nevertheless, it is possible to concentrate on a defined num- 
ber of component failures, rather than what causes a failure of the product or system 
at large. Furthermore, it is worth mentioning that the number of possible failure 
scenarios increases with the number of components and design options. Hence, the 
enumeration of all possible failure scenarios becomes practically impossible. More 
details on resilient system design can be found in Sect. 6.3. 


Review of legal obligations 


In order to identify the manufacturer’s duty of care when using optimisation methods, 
we take a closer look at the selection of the model on which algorithmic design 
methods are based on and differentiate between optimisation methods in general and 
resilience optimisation methods. 


Selection of the model 


All algorithmic design methods are based on a model of the system. In order to 
specify the legal obligations when using algorithmic design methods, considering 
the selection of the model of the system should be the starting point. These models 
always represent reality in a simplified way, see Sect. 1.3. Therefore, one model only 
applies to the specific application for which it is designed. If a model is used for 
the development of an application for which it does not provide reliable informa- 
tion, considerable deviations between the modelled system behaviour and the actual 
behaviour can occur during the usage phase. 

It is important to note that in most cases many models are available, while some 
represent reality better than others. This results in the important restriction of the 
most reliable models often being too complex and thus too time-consuming for 
computation. In this respect, the developer needs to find a balance between an accurate 
model and the appropriate computation time. 

When discussing legal obligations, the level of risk to third parties’ protected 
rights has to be determined and should be foreseen by the developer of a product [26, 
marg. 6]. First of all, the developer would have to ensure that the model he uses can 
generally provide reliable information about the product. The developer also needs 
to take the boundaries of the model into consideration, cf. Sect.2.2. Furthermore, 
he has to have some kind of proof that the approximations made on the basis of the 
underlying model transfer into reality. This is usually achieved by model validation 
and verification. With the help of either experimental data or simulation results, it 
can be shown that the predicted behaviour is in accordance with the actual behaviour 
of the product. This procedure can be expected from the developer. Validating the 
model can imply that the producer of the product has fulfilled the safety obligations 
in the development phase. But in order to fully protect the developer from liability 
claims, safety aspects must be reproduced by the model as well. 
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Use of optimisation methods 


Optimisation methods allow the development of more complex systems or products, 
as they simplify the design choices for the development process. These methods 
are based on mathematical models of the system and its environment. As already 
mentioned, one of the causes for uncertainty in using such methods arises from the 
fact that models can never be an exact representation of reality, as the latter is too 
complex to be computed. The outcome of the design with optimisation methods 
depends on the chosen model and on the chosen input parameters. These parameters 
are mostly economical and structural factors set by the developer. Moreover, the 
number of input parameters is finite. Safety of the product as such cannot be an 
input parameter. In fact, an optimal solution for the given optimisation problem can 
be structurally unsafe. This becomes clear, when considering optimisation problems 
that are used to minimise the material usage of a product. 

As the producer cannot rely on the optimisation method to choose a particularly 
safe product design, he still needs to ensure that safety standards are met. So far, 
this process does not deviate from a development process which does not rely on 
optimisation methods. In a conventional development process, the developer would 
consider different design alternatives which solve the problem defined. These are 
the alternatives the developer would then have to choose from [274, marg. 972]. The 
decision would be made considering functionality and economic factors. Simulta- 
neously, safety requirements can and should be considered when choosing the final 
product design. 

In using optimisation methods for product development, the numerous possible 
design alternatives are not considered by the producer himself. The algorithm decides 
on one single product design that fits the defined problem the best, given the pre- 
defined input parameters. Output is therefore only one optimal design option. This 
one design alternative can of course be tested by the producer considering safety 
aspects. Conventionally, this does not suffice legal standards as they are developed 
by jurisdiction. The act of choosing the design and the consideration accompany- 
ing that process represents an important step that is ascribed to the producer. But 
imagining the producer would have to trace back every possible design alternative 
the algorithm considered during the optimisation process, all facilitation gained by 
using the algorithm would be lost. Apart from that, the time, cost and computational 
efforts would be great. Only measures are legally expectable, that are reasonable. 
These legal standards need to be adapted. Otherwise, innovations might be hindered. 
Therefore, to demonstrate the safety of a product in a way that exonerates the producer 
from liability claims, it needs to be possible to check only the design alternative the 
algorithm provides as an optimal output. Then again, it has to be taken into account 
that complex products or large systems, such as a bridge, cannot be tested in ‘real 
life’. Prototypes have their limits, where the size of the system or the number of 
components exceeds the feasible. Consequently, producers need to check and prove 
the safety of a product or system by using simulation methods. Then, the problem we 
discussed at the beginning becomes relevant again. Simulation algorithms are based 
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on models of the product and its environment. Hence, the producer has to be certain 
about the boundaries of the simulation and the underlying model. 


Use of resilience optimisation methods 


Resilience optimisation enables the development of systems and products that can 
withstand a defined number of failures of an undetermined cause. For a defined 
number of failures within the system, functionality can be guaranteed. It is not pos- 
sible to foresee every possible damage scenario in the development. The resilience 
optimisation method can therefore make this uncertainty more manageable. If the 
identification of potential users and dangers to them and third parties has been an 
essential part of a developer’s duty of care up to the current moment, this is no longer 
considered when using resilience optimisation methods. The system developed in 
this way guarantees a minimal functionality despite unknown failure scenarios. As 
long as the functionality of the system is guaranteed, no one will be harmed. At 
least in theory, resilience optimisation promises safer products. In reality, however, 
it is uncertain how these systems react to failures or damage events. Furthermore, 
the model and data uncertainty within the design stage might be significant. Never- 
theless, resilience optimisation can be used to support engineers in the early design 
stage as for instance shown in Sect. 6.3.5. 

As with the development of any new technology, the question is whether the prod- 
uct can be brought to market at all. If the risks of the product cannot be weighed 
against the supposed safety gain, marketing cannot be recommended [35, marg. 17]. 
It should also be noted, however, that currently neither standards nor practical experi- 
ence can be used to develop products using resilience optimisation methods. In order 
to answer the question of marketing, appropriate methods for assessing the risk of 
the systems would have to be developed first. If the comparison with conventionally 
optimised systems turns out to be in favour of the safety gain, the product can be 
marketed. 

Once this fundamental question has been clarified, the question still remains how 
the current legal framework can be transferred to the systems developed in this 
way. So far, the starting point has been, among other things, the obligation of the 
manufacturer to correctly assess the danger of the product for potential users, as 
well as third parties. This assessment should then be used as the basis for selecting 
an appropriate design. As already discussed regarding the conventional optimisation 
methods, the selection of a design alternative is now left to mathematical optimisation. 
Furthermore, due to resilience optimisation methods, the preceding step of assessing 
potential danger and user is omitted. 

In the end, all that remains is the legal premise that the manufacturer must do 
everything reasonable to ensure the necessary safety of the product. What the man- 
ufacturer can reasonably be expected to do must be determined by weighing up the 
interests of the parties involved [29, marg. 10]; [27, marg. 7]. First and foremost, 
it will be a matter of comparing the expected safety gain from resilience optimised 
products and the remaining residual risk. Moreover, it must also be considered which 
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legal interests are potentially at risk. The higher the significance of these legal inter- 
ests is classified, the more resource-intensive security measures can be expected [30]; 
[35, marg. 8]. For example, if a person’s life is at risk, the producer is expected to take 
more costly precautions to avoid this danger compared to a case in which a person’s 
property is endangered. Nonetheless, the economic interests of the manufacturer can 
also be taken into account [35, marg. 18]. The development process becomes faster 
and ideally safer by implementing resilience optimisation methods. An obligation 
to simulate all possible failure scenarios would take a great amount of time, effort 
and resources. The entire reason why resilience optimisation methods are used in the 
development process of new products would be counteracted. One can therefore not 
expect the manufacturer to simulate all imaginable failure scenarios of the product 
for each design alternative. Otherwise, legal requirements would hinder innovation 
in product development which should not be the aim of technology-friendly devel- 
opment of the law. 

The priority of all obligations concerning the development of a safe product is 
currently the duty of care in construction. Primarily, the producer has to ensure 
that the design of the product is safe [103, marg. 71 ff.]. Further obligations, such 
as instructing the user of the product to limit the use to a specific application or 
monitoring the product during the phase of usage, are only secondary. But considering 
the aforementioned points, it is relevant to see a shift in prioritisation of the producer’s 
obligations towards an increased importance of monitoring the product in its usage 
phase. First of all, it is important to limit the risks that still accompany the use of 
resilience optimisation techniques, secondly, to learn from products’ behaviour “in 
the field”. 


Conclusions 


Considering the information gathered, we can establish the following key findings 
from our work on legal requirements for the use of optimisation methods. The devel- 
oper must be aware of the boundaries of implemented and used models. At the same 
time, the developer is also expected to validate the used models. When using optimi- 
sation methods for development, the developer can check only one optimal solution 
provided by the algorithm for compliance with safety requirements. Checking can 
also take place by using simulation methods. Before using resilience optimisation 
methods, the developer needs to prove that the gain of safety outweighs the remaining 
risks that are unknown. But the necessary methods need to be developed first. If this 
consideration turns out in favour of the use of resilience optimisation, new priorities 
in legal standards still need to be set. How to set these priorities will have to depend 
on the methods developed in the future. The main focus of the developer is to lie on 
monitoring the product during the usage phase to ensure the safety of users and third 
parties. 
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5.1.6 Linguistic Analysis of Technical Standards to Identify 
Uncertain Language Use 


Jörn Stegmeier, Jakob Hartig, Michaela LeStakova, Kevin T. Logan, Sabine Bartsch, 
Andrea Rapp, and Peter F. Pelz 


Technical standards play a major role in the entire product life cycle by standardising 
rules for the exchange of information, ensuring compatibility and reducing the vari- 
ety of products, services, interfaces and terms. Technical standards are developed 
by international, national, and regional associations and are not to be confused with 
legal standards [102]. As we get to know in Sect. 5.1.3, the application of technical 
standards is voluntary in principle, but may as well be legally binding by law or con- 
tract. In both cases, technical standards should reduce the uncertainty of the product 
under development by defining formal quality requirements for product development 
(cf. Sect.5.1.1 and 1.6). Consequently, unclear language use in technical standards 
leads to uncertainty during the product development process. In this section, we 
therefore focus on the linguistic analysis of technical standards to identify uncertain 
language in technical standards. 

Since we do not know the impact of “semantic uncertainty” in standards on the 
product, its use and on its acceptance, we have to speak of “ignorance” (see Chap. 2). 
The aim of this study is an annotation method to avoid this ignorance with the help of 
an information system. The user of the information system can master uncertain lan- 
guage with the help of annotations, that give him or her hints that there is uncertainty 
and how to proceed. 

A general requirement for technical standards, apart from the use of plain lan- 
guage, is the use of clear and concise expressions [76]. In contrast to that, Drechsler 
found that among users of technical standards, there is a considerable lack of knowl- 
edge of how technical standards are to be interpreted [82]. This discrepancy is not a 
coincidence but rather a consequence of the need to generalise technical standards in 
certain parts to make them applicable in a variety of contexts. However, underspec- 
ification inevitably leads to uncertainty as to how to correctly interpret the technical 
standard’s intent. Two conditions must be met to bridge the gap between deliber- 
ate and necessary underspecification and all the additional information needed for 
correct interpretation and, hence, full compliance with the intent of the technical 
standard. Firstly, the user of the technical standard must be aware of this gap and, 
secondly, the user needs to know where to find the missing information. 

If we consider sentences with “should” for example: While “should” conveys a 
certain intent, it can also be interpreted as a mere suggestion. The uncertain parts 
of technical standards are not as easy to spot as the occurrence or the meaning of 
“should” illustrates in the following examples: Example 1: “Dies gilt insbesondere für 
Apparate, die einer regelmäßigen Inspektion und Wartung bedürfen”. [In particular, 
this applies to devices that are in need of scheduled inspection and maintenance.][71, 
p. 38]. Example 2: “Die mit Trinkwasser in Kontakt kommenden Werkstoffe [...] dür- 
fen Stoffe nicht in solchen Konzentrationen an das Trinkwasser abgeben, die höher 


242 P. Groche et al. 
sind als nach den allgemein anerkannten Regeln der Technik unvermeidbar [...]”. 
[The materials that come into contact with drinking water are not to release sub- 
stances into the drinking water in concentrations higher than unavoidable according 
to the generally recognised rules of technology.) [71, p. 15]. 

In Example 1, there is no list of concrete devices, which makes this passage 
uncertain for as long as the maintenance needs of all devices used in a project are not 
checked and documented. While the solution—looking up technical specifications 
provided by the manufacturer—to the uncertainty in Example 1 is straightforward, 
Example 2 presents the user with a less clear-cut issue. There is no single manual 
or document that records the generally recognised rules of technology. To obtain 
the necessary information, engineers have to either rely on experience by utilising 
solutions from earlier projects, or they must find examples of solutions which clearly 
follow the generally recognised rules of technology. 

The practice of how technical standards enter the process of product development 
also comes into play. There are various possibilities, all of which to be found on 
a scale between the following scenarios. Scenario 1: The users study all standards 
pertinent to a specific project. Scenario 2: The users study a subset of the pertinent 
standards whenever the need arises. Scenario 1 is unlikely due to the sheer number of 
pertinent standards; Scenario 2 inevitably leads to a number of uncertain statements 
in pertinent standards being overlooked. In any case, due to the uncertainty inherentin 
standards, none of the scenarios addressed leads necessarily to a standard-compliant 
product development without further steps. 

In each of these cases, an information system which shows all (potentially) uncer- 
tain parts of pertinent norms can assist the user in dealing with uncertainty not only 
by alerting him to its presence but by informing him of its nature, and by providing 
hints, as to where further pertinent information can be found. The primary goals of 
this study are therefore twofold: (i) creating a taxonomy of uncertainty in technical 
standards, and (ii) developing an information system which displays uncertain parts 
and their classification to the end user. For a detailed account of the latter, see [254]. 

The technical standards chosen for analysis in this study are from the DIN 1988 
series “Codes of practice for drinking water” due to their relevance for Sect. 6.3.5. 


Basic notions and methodology 


Standard-compliant product development requires knowledge of the pertinent tech- 
nical standards and of anything needed to resolve any uncertainty inherent in the 
standards. Uncertainty can arise from ambiguous language as well as from lack of 
(specialised) knowledge. From a linguistic perspective, the meaning of a word is a 
cognitive entity (= concept) evoked by perceivable linguistic entities, such as strings 
of characters or sounds (= word forms). The concept is both an abstract representa- 
tion of an entity in the world (= object, phenomenon) and a reference to this entity. 

The relationship between words, concepts, and objects in the world can be char- 
acterised as triangular, and is commonly described as the Semiotic Triangle [211, 
p. 11]. Special knowledge often needs specialised language, which can be accom- 
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plished in several ways: New words like “Covid-19” may be created and spread with 
the express purpose of evoking a specific concept referring to a concrete object or 
phenomenon in the world. Also, existing words can be re-purposed by expressly 
restricting the concepts they evoke (= defining their meaning) or by using them in 
a specific way or in a specific context, such as “mouse” in the sense of “peripheral 
computer device”. 

We understand uncertainty to mean a condition in which further steps of knowl- 
edge acquisition need to be taken to ensure standard compliance. Standards are not 
data in the sense of numbers, but more or less vague instructions for action that must 
be interpreted and supplemented by knowledge acquisition. Thus semantic uncer- 
tainty does not fit directly into the uncertainty classification from Chap.2. Knowl- 
edge acquisition, in turn, is a process of understanding by interpreting information 
according to previous knowledge and applicable rules. We draw on the DIKW model 
(data, information, knowledge, wisdom) [4, 24, 230] in order to differentiate between 
knowledge, information, and data: data is a record of knowledge disassociated from 
the human mind, information is the result of cognitively processed data, and knowl- 
edge is the result of understanding the information by way of interpretation. 

Annotating has a long-standing tradition in humanities and can be regarded as 
both, a part of knowledge acquisition and a scholarly primitive approach [193, 265]. 
We used the web service Weblicht [157], provided by CLARIAH DE [169], to 
automatically assign the base form (= lemma) to each word. This facilitates searches, 
for instances of word types, even if those word types have differing surface forms. 
For the manual annotation of uncertain words and phrases, we used the software 
INCEpTION [172] which can access multiple annotation layers (like part-of-speech 
and lemma) and allows for bottom-up development of annotation schemes. 

Taxonomy design needs to incorporate a clear “differentiation between instances 
and classes” [287, p. 377], which in our case has been accomplished by a simple 
rule: Any concrete segment of text that demands further steps of knowledge acqui- 
sition is an instance of the super-class uncertainty and needs to be classified further. 
We employed a mixed development process, combining top-down and bottom-up 
approaches [208]: Previous knowledge of technical standards led us to distinguish 
evident from hidden uncertainty (top-down approach). Evident uncertainty means 
any uncertainty that remains after studying the norm text while hidden uncertainty 
arises from a conflict between individual knowledge and the specifications presented 
in standards. Prototypically, hidden uncertainty is individual and cannot be annotated 
which is why we concentrated on the branch of evident uncertainty. The subcategories 
of hidden uncertainty were developed in a bottom-up process. 


Results 


Evident uncertainty, a result of linguistic ambiguity, is divided into the semantic 
uncertainty and referential uncertainty, see Fig.5.7. With regard to knowledge acqui- 
sition, semantic uncertainty is situated between information and knowledge and hin- 
ders the process of understanding while referential uncertainty is situated between 
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Fig. 5.7 The classes shown are a result of the manual annotation of norm texts on the level of single 
and multi-word expressions (phrases) 


data and information, and expands the pool of information, which needs to be part 
of the knowledge acquisition. The sub-classes of semantic uncertainty account for 
different forms of meaning related uncertainty. Modality covers any instances where 
uncertainty arises from modal expressions, such as “can” or “should”, while under- 
specification covers anything else. The sub-classes ofreferential uncertainty cover all 
instances of references in the technical standards. Known targets are all instances of 
named sources like “Diese Norm gilt in Verbindung mit DIN EN 806-2 [...]” [This 
standard applies in conjunction with DIN EN 806-2] [71, p. 6] while unknown targets 
are references to unspecified sources like “Es sind die technischen Anweisungen der 
Hersteller zu beachten.” [The technical specifications of the manufacturer are to be 
observed.] [71, p. 19]. 


Towards automated annotation using machine-learning 


The next steps focus on automation with regard to both, document import and anno- 
tation. The first steps towards a cooperation with Beuth to provide XML files instead 
of PDFs have been taken. The annotation process is improved by making use of 
Inception’s in-built machine-learning (ML) and string matching capabilities. For the 
sake of proper ML work, a larger number of standards are annotated. For the string 
matching, the instances of the class semantic uncertainty and, to a lesser extent, 
of the class unknown target will be used to automatically retrieve synonyms from 
resources made available by lexicographic projects. Possible resources are the Dig- 
itales Wörterbuch der Deutschen Sprache [Digital Dictionary of German] [148], the 
project openthesaurus.de [204], which is also the basis for the information provided 
in DWDS. Further services are DeReKoVecs [100], which analyses the relationships 
between words occurring in the Deutsches Referenzkorpus (DeReKo) [German refer- 
ence corpus] and GermaNet [140, 154], alexical-semantic net [153]. These measures 
are going to enable us to annotate both, technical standards which are directly perti- 
nent to a given project, and technical standards which are referenced by these. Thus, 
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users of the information system are going to profit two-fold, namely gain insight 
into uncertain parts and their classifications to then follow and master uncertainty 
spanning multiple documents. 


5.1.7 From Risk to Uncertainty-New Logics of Project 
Management 


Martina Heßler 


This book analyses how “to ensure product safety in a world of products with ever 
increasing complexity”. Thereby “mastering uncertainty is central”, and, as empha- 
sised in the introduction, it “requires contributions from engineering, mathematics 
and law”, cf. Chap. 1. 

This section broadens the view in two respects. First, it examines how uncertainty 
is conceptualised and handled in the scientific discipline of project management. 
Second, it does so from a historical perspective by describing a historical shift in 
concepts in terms of dealing with uncertainty in the 1990s. The historical analysis 
of the changing term of uncertainty and the changing concepts developed by the 
discipline of project management leads to a better understanding and classification 
of current tools for planning processes in general. 

In the second half of the 20th century, project management developed into a 
scientific discipline in order to ensure that projects are managed, controlled, and 
secured to run according to plan. Uncertainty is regarded as an “obstacle and a 
threat” [42, p. 5] to project success. Uncertainty should be minimised and made 
controllable. That does not come as a surprise, since challenges and problems that 
arise from unknown, unplanned or unexpected events and developments are obvious. 
In a recent study, Heidling stated that, of 318 projects “in the area of industrial, global 
large-scale projects 64 % (failed) to achieve the planned project goals” [150, p. 17]. 

The capacity of managing uncertainty is of great importance for the success of 
projects, especially in the context of increasing complexity and rapid change. In 
the relevant publications and journals of professional project management, this has 
been a topic of debate for many decades. The question of how uncertainty can be 
mastered led to many publications that questioned existing concepts and discussed 
new concepts for dealing with uncertainty. It is striking that the problems of dealing 
with uncertainty are addressed far more frequently than success factors that make 
uncertainty manageable. 

This section asks (i) how uncertainty has been conceptualised in the discipline 
of project management over the last decades, and (ii) which methods have been 
developed for mastering uncertainty. In particular, the goal is to reveal the theoretical 
foundations and premises of project management, thus contributing to a fundamental 
understanding of the changing logic of project management. This section is based 
on programmatic publications within project management as a discipline. A study 
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by Heidling, summarising and evaluating journal articles from the 2010s, should be 
highlighted, since it provides important insights for what follows in this section [150]. 

It is important to note that project management as a scientific discipline develops 
rather general and abstract models that do not focus on the specifics of various 
technological disciplines. Although project management emerged in the context of 
large technological projects, such as the development of the atomic bomb and space 
travel, models of project planning are being developed for various areas, from large 
technical projects to the planning of technological innovations to business projects 
and events. Therefore, this section does not deal with uncertainty in the process of 
product design, nor primarily with the control of technically induced uncertainty, but 
with uncertainty during the entire process of planning a project in general. 

The thesis that will be developed is that, in the second half of the 20th century, 
we can observe a change in the concepts of uncertainty within project management, 
which led to the recognition of ignorance as a fundamental premise of all projects. 
In the theoretical foundations of project management, a paradigm shift happened: 
Uncertainty was redefined. The primary goal here is to analyse this change in concepts 
within the discipline of project management in the 1990s. 

Before we can elaborate on that, it is necessary to take a closer look at the termi- 
nology used in project management and relate it to the terms used in this book. The 
terms of project management are strongly influenced by societal and sociological 
discourses. To make this clear: That which Chap. 2 of this book labels stochastic 
uncertainty, project management calls risk. In the models of project management, 
risk refers to possible, but not foreseeable events in the future that are known in 
principle and whose probability of occurrence can be calculated. However, further 
questions are asked, particularly in sociological discourse. It is asked how risks are 
produced by whom, how they are perceived by different actors and what significance 
is ascribed to them in each case. Thus, risk is a quantitative and qualitative category. 

The technical term incertitude, cf. Chap. 2, is not used in the debates and models 
of project management at all. And while this volume differentiates further by distin- 
guishing ignorance from incertitude, as defined in the introduction, within project 
management the term uncertainty is much less differentiated. While a paradigm shift 
in project management is clearly evident, the terms remain more vague than in the 
engineering disciplines. Models in project management only distinguish between 
risk and uncertainty. The interdisciplinary research field of Science Studies, which 
situates scientific knowledge in historical, philosophical and social context, in turn 
speak of the latter as unknown-unknowns, while this book uses the term ignorance. 

Even before that distinction between risk and uncertainty has been drawn and a 
redefinition of the term uncertainty was discussed in the discipline of project man- 
agement in the 1980s and 1990s, uncertainty has already been a category of project 
management, for example as technical uncertainty. 

While in the first decades of project management the focus actually was on tech- 
nical uncertainty, it has become obvious, from the 1970s and 1980s onwards, that not 
only the complexity of projects but also the complexity of uncertainty has increased. 
Societal processes became factors of uncertainty, such as civic protests against large- 
scale projects or the emergence of societal resistance to new technologies, for exam- 
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ple. The pluralisation of the stakeholders involved, accelerated change processes, 
and changing market conditions, these developments all contributed to redefining 
the concept of uncertainty. 

Thus, in a first step, the focus shifted from technical uncertainty to risks, thereby 
including technical, social and economic factors. In project management the concept 
of risk became central, e.g. [203]. At that very time the concept of risk also shaped 
social debates and the social science literature, e.g. [19, 227]. 

As early as the 1990s, however, the concept of risk was heavily criticised since 
it still aimed at controllability and mastering. In contrast, a redefined concept of 
uncertainty (here, exclusively meaning “ignorance”), which stressed the basically 
incalculable part of planning, was brought to the fore. This was accompanied by 
demands for new ways of dealing with such fundamental uncertainty in project 
planning. It is remarkable that this development can also be observed simultaneously 
in Science Studies and decision theory. 

Similar strategies for dealing with uncertainty have been addressed within sci- 
entific project management as a discipline, as they are presented in Chap. 6 of this 
book, as will be shown in the following. 


Risk versus uncertainty 


The range of possible, unforeseen events that get in the way of project planning is 
wide. It ranges from technical problems, changes in the market, political or legal 
framework conditions to changes in the composition of the team, to name just a 
few factors. In an essay from 2013, Thamhain lists additional, concrete examples 
of uncertainty: “the failure of a certified component with proven liability in simi- 
lar applications, a sudden bankruptcy of a customer organisation, or a competitor’s 
breakthrough invention/innovation that undermines the value of your current project 
or threats a major line of business. By definition, unknown-unknowns are not fore- 
seeable and therefore cannot be dealt with proactively” [260, p. 23]. If the types 
of uncertainty enumerated here are neither new nor surprising, the decisive point 
is the reference to the unknown-unknowns (ignorance), which began to shape the 
discourse within project management starting in the 1990s. Uncertainty, in contrast 
to risk, thus refers to something that is incalculable; thus it evades planning. 

Since the 1990s, this has been emphasised as a new challenge in project manage- 
ment and can be observed analogously in Science Studies, which have dealt with the 
concept of the unknown-unknown. As Peter Wehling summarised, conflicts about 
the risks of genetic engineering and nuclear technology in the 1970s and 1980s 
had already made it clear that societies were confronted with a new form of the 
unknown, namely “the unknown as an unknown threat” [276, p. 485]. The discovery 
of a fundamental, unpredictable ignorance went hand in hand not only with the new 
technologies already mentioned, such as genetic engineering and nuclear energy, 
but also with the perception of living in times of accelerated scientific and social 
change [10, 276]. 
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However, while this was initially addressed under the term risk, this description 
proved to be inadequate, since risk was associated with the possibility of calculat- 
ing and thus mastering it. As already indicated, the newly perceived challenge lay 
precisely in the fact that phenomena exist, which are “events that are known and 
predictable in principle”, as the term risk suggested, but that “the consequences of 
scientific and technological innovations [...] are simply unknown and incalculable” 
[277, p. 100]. 

Since the 1990s, project management has been asked to accept the unpredictable as 
an unavoidable dimension of every project and to find a different way of dealing with 
it. Exactly as was the case in the Science Studies, in project management, too, this was 
formulated as a criticism of the risk concept. Within project management, the concept 
of risk had also been used to refer to “events that are not completely predictable 
and controllable”. However, the assumption still was that “the probability of their 
occurrence could be calculated”. According to this logic, risks were transferred to 
the mode of predictability — thus becoming controllable. “Despite the recognition of 
uncertainty, certainty is nevertheless sought”, summarised Bohle [42, p. 5]. 

However, in contrast to assuming that uncertainty is a calculable unknown, begin- 
ning in the 1990s, the concept of uncertainty has been redefined in a fundamental 
way within the field of project management. A newly emerging debate within project 
management suggested abandoning the ideas that certainty is possible at all and that 
uncertainty can be calculated, which were associated with detailed planning. 

This was a provocation at odds with many modern ways of thinking taken for 
granted. For example, in the mid-1990s, J. Davidson Davidson Frame, had tied the 
concept of risk to the question of available information. He held the view—also 
common in decision theory—that little or incomplete information itself was a risk 
[105]. Therefore, the solution was to have as much information available as possible. 
This corresponded to a modern view of science in general: the assumption was that 
the accumulation of knowledge would eliminate ignorance [276, p. 485]. 

However, by the 1970s and 1980s at the latest, it became clear that as projects 
became more complex, ignorance in the sense of the unavailable and uncontrollable 
also increased, see [226, p. 423]; [189, p. 1106]. Unknown-unknowns—which, in 
terms of project management, constituted uncertainty—are therefore not the result of 
incomplete information or of something that is not yet known, but rather something 
that at a certain point in time is, as a matter of principle, not knowable, and thus not 
calculable. 

According to this logic, a distinction between risk and uncertainty (as inignorance) 
has been introduced to project management [203] in order to make uncertainty— 
understood as ignorance or unknown-unknowns—a topic of project management and 
to develop new methods for dealing with and ultimately mastering it. In a nutshell: 
In the 1990s, uncertainty was discovered as something unpredictable and recognised 
as an unavoidable problem. This conclusion was accompanied by the demand to 
accept it and therefore to “develop capacity to act with uncertainty” in the sense of 
ignorance [42, p. 7]. 

But what did this mean for dealing with uncertainty in project management? What 
does it mean for the methods developed within the discipline of project management? 
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Criticism of quantitative and standardised methods 


The conceptual shifts from the concept of risk to a stronger emphasis on incal- 
culable uncertainty were, unsurprisingly, accompanied by criticism of quantitative 
methods. Starting in the 1970s, methods were being developed to quantify risks and 
to make probabilities of occurrence controllable by using mathematical-statistical 
methods [203]; [150, p. 19]. As Heidling emphasises, the concept of risk was 
inseparably linked to predictability and calculability [150, p. 18]; [279], see also 
DIN EC 62198 [73]. But doing so in this context was considered inappropriate for 
the novel focus of challenges posed by uncertainty in the sense of ignorance. 

In the field of Science Studies, quantitative, probabilistic methods of risk analysis 
have been criticised and described as the expression of a “reductionist, analytical 
worldview” and as such regarded as necessary to overcome [110, p. 739]. 

The aforementioned assumption that more information and more knowledge lead 
to mastering planning processes, was also questioned. For example, the pursuit of 
completeness of information as the basis for project management was criticised as 
not leading to the expected results. This was accompanied by the critical reflection of 
very detailed, sequential planning processes [260, p. 20f]. Archibald pointed out that 
the traditional approach of using large amounts of information as basis for detailed 
planning would not lead to solutions, especially when dealing with uncertainty [10]. 
It was important to not consider as many factors as possible, but rather the “most 
important” ones. However, these are “often those with the greatest uncertainty, and 
the new logic requires giving them priority over the easy, material, more certain 
ones” [10]. 

Furthermore, using concepts like controlling and monitoring to predict future 
events correctly and in a systematic way was not considered helpful in meeting the 
challenges of uncertainty [150, p. 17]). 

Closely connected with such criticism of reductionist, analytical methods were the 
questioning of project management methods which dealt primarily with unambigu- 
ousness, which by now was regarded as inappropriate. In the 1990s, an interesting 
attempt was made within project management to use fuzzy logic to break up an 
orientation towards unambiguity in order to calculate uncertainty [10]. 

Summarising the criticism of dealing with ignorance, it can be said, in a nutshell, 
that the previous methods, based on calculation, quantification and detailed, sequen- 
tial planning, were considered obsolete. They were criticised as ineffective when the 
problem of uncertainty was addressed in terms of dealing with the unplannable. 

In essence, this constitutes a fundamental criticism that these methods were char- 
acterised precisely by the fact that they were a means of planning the plannable, i.e., 
calculating the calculable and the knowable, and therefore did not even consider the 
unplannable and ambiguous. That which could not be planned was, according to the 
criticism, simply ignored. However, it was precisely this systematic omission that 
led to problems during the execution of projects. Thus, a fundamental critique was 
formulated, which posited that the limits of the methods had not been reflected upon. 
Thus, the model entailed only that which could be controlled within the confines of 
the model (quantifiability), see similarly [42, p. 8]. 
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This criticism, often voiced within the project management community, resulted 
in the demand that dealing with uncertainty required a new logic and new procedures, 
especially in times of “accelerating rate of changes” [10]. 


Paradigm shift: a new logic in project management? 


If we now look at what was supposed to characterise this new logic and new methods, 
it quickly becomes clear that the criticism of the so-called traditional concepts was 
much more incisive than what was asked of the new models and procedures. Defining 
the problem proved to be easier (until today) than finding a solution. In the same way, 
this applies to Science Studies or decision theories. Here, the answers to the question 
of how to deal with uncertainty looked strikingly similar. 

Firstly, ways of thinking and approaches based on competences considered 
innately human were said to be, by their “nature”, counter to quantitative, standard- 
ised and rationalised procedures. It is especially the unpredictable that requires human 
experiential knowledge, intuition, heuristics and fuzzy thinking by real humans, as 
was often emphasised. As the horizon was to be extended beyond the measurable 
and quantifiable and diagnosed reductionisms were to be overcome, other heuristic, 
intuitive methods were now seen as appropriate solutions for dealing with uncer- 
tainty [10]. 

This was accompanied by an emphasis on the role of humans, who were no longer 
perceived as disruptive factors or in need of containment due to their subjectivity and 
assumed irrationality, but were discovered as potential. Using human skills was now 
considered the best way to react quickly and flexibly, which is very important when 
dealing with uncertainty. 

Furthermore, demands were made for a holistic and synthesising approach, which 
would make interrelatedness and processual thinking the basis of planning, and even- 
tually replace linear-causal thinking [10]. 

The calls for a new way of dealing with ignorance culminated in the demand to 
not only to accept uncertainty as inevitable but to see it as an opportunity: “Instead of 
considering uncertainty as a necessary evil, it should be considered as an extremely 
important, inspiring and useful factor given its inherent opportunities for making 
improvements and taking measures against risk. In the author’s opinion, uncertainty 
is likely to hold some of the greatest potential for improving management skills and 
efficiency today” [186, p. 21]. 

Uncertainty was thus even interpreted as an opportunity to improve things in 
ongoing projects, to react flexibly with the goal of ultimately becoming more efficient. 
Contrary to the idea of creating robust, nearly rigid project plans, a clear plea was 
made for flexible, incremental, almost improvising action. 

If one compares the strategies for handling ignorance, which were discussed 
in project management in the 1990s, to the strategies for mastering uncertainty 
described in this book, fundamental similarities can be stated. The strategies to man- 
age uncertainty in technical systems, described in Chap. 6, are robustness, flexibility 
and resilience. Even if the term resilience did not play a role in the models of project 
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management, the efforts to permanently adapt and flexibly ensure the success of the 
planning process when faced with unforeseen challenges clearly correspond to the 
concepts described in Sect. 6.3. That holds particularly true for the role of humans 
in mastering uncertainty, which has proved to be the core concept of the new logic 
of project management since the 1990s. 

However, aremarkable difference also needs to be noted. Most of the concepts pre- 
sented in this book refer to technical systems, thus having to ensure that technology 
itself proves robust, flexible and resilient. Therefore, both quantitative-mathematical 
models as well the interplay of humans and technology provide a solution for mas- 
tering uncertainty. 

In contrast, project management focuses on the planning process of projects of var- 
ious kinds, which inevitably implies ignorance in terms of social, economic and polit- 
ical developments. Thus, since the 1990s, concepts have been developed that empha- 
sise human capabilities, thereby constructing a strong contrast between humans act- 
ing with uncertainty (ignorance) on the one hand and quantitative-mathematical 
models to master ignorance on the other hand. 

This constitutes a move away from a paradigm of steering, controlling, measuring, 
calculating and detailed and sequential planning of projects; it can be summarised 
with a picture used by Perminova et al.: Projects should be conducted as an explo- 
ration or an open-ended journey rather, and not as a precisely planned sequence of 
steps [221, p. 74]; [150, p. 24]. However, this almost poetic description often clashes 
with the efficient culture of controlling in many organisations as well as with the 
design of techno-economic systems. 


Summary and outlook 


When looking at the premises and theoretical foundations of project management 
with regard to dealing with uncertainty, there is no doubt that a fundamental paradigm 
shift has taken place since the 1990s. The description of uncertainty as a risk, which 
implies the assumption that planning processes are manageable and controllable by 
quantification and probabilistic methods has been questioned fundamentally. This 
has been accompanied by a shift in terminology from risk to uncertainty in the sense 
of ignorance. Dealing with uncertainty, i.e., with phenomena that one does not even 
know one does not know, required new methods, which, in simple terms, focused 
on intrinsically human characteristics, such as experiential knowledge, intuition, as 
well as heuristics and holistic thinking 

The debate within project management, which boasts many analogies to debates 
within science studies and decision theory in the 1990s, reflects social and techno- 
logical challenges. These include not only genetic engineering and nuclear energy, 
which are always mentioned, especially in science studies, but also disillusionment 
in the context of artificial intelligence (AI) research. It was precisely here that the 
limits of quantitative, so-called “brute force” methods and the “Good Old-Fashioned 
AT” methods became very clear in the 1980s. 
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Putting the demand for a new logic of project management into historical context, 
the turn towards so-called human competencies becomes apparent, as a result of the 
limitations of technological methods, as well as of challenges arising from new tech- 
nologies. This brought about a new dimension of ignorance. Disillusionment and the 
experience of the limits of mathematical-statistical-technical planning methods led 
to an emphasis on human-based planning procedures, and it also brought previously 
underestimated and unnoticed factors into focus. 

The question of how to deal with uncertainty and, above all, unforeseen events 
in projects of all kinds remains a core question for their success. There is a lack of 
systematic and empirical, and above all historically comparative, studies focusing on 
this question, which, on the one hand, analyse concrete planning practices, and on 
the other hand, describe the empirical level chronologically up to the present. After 
all, concepts, methods and practices of project management are always time-bound. 
They do not only react to changing challenges by developing new approaches. The 
answers to new challenges also reflect contemporarily dominant approaches, as the 
strong focus in the 1990s on experiential knowledge, intuition and heuristics shows. 
This does not mean that the answers are not accurate. However, looking at things 
from a historical perspective makes it clear that one mainstream might chase the next. 
That means that we also have to critically reflect current trends: Construing a contrast 
between human behaviour, capabilities and technical (quantitative-mathematical) 
solutions, which was typical for the 1990s, is now being replaced by a stronger 
emphasis on the interaction and close cooperation between humans and machines. 

However, no universal solution for this unpredictable uncertainty has been devel- 
oped, nor are project management practices actually being driven by this insight 
(yet). 


5.2 Product Design Under Uncertainty 
Peter Groche and Hermann Kloberdanz 


The entire life cycle of a product is predetermined by the product design. Since all 
three phases of the product life cycle design, production and usage are accompanied 
by uncertainty, see Sect. 1.2, an adequate anticipation of this uncertainty is the key for 
a successful product design. This anticipation is very demanding, because normally 
neither the involved stakeholders nor the events that occur in a product life are known 
a priori. We propose to tackle this challenge with several methods that uncover and 
help to reduce uncertainty in all stages of the design process in a systematic way. 
The newly introduced “Uncertainty Mode and Effects Analysis” (UMEA), 
described in Sect.5.2.1, allows for analysis and evaluation of occurring uncertainty 
in all phases of the product life cycle. One approach to reduce uncertainty in the 
design phase is the systematic involvement of stakeholders. This involvement can be 
used to reduce the fluctuation of requirements during the development and increase 
of the knowledge about the product to be developed by extending the designers’ 
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model horizon, see Sect. 1.3. A systematic approach for this involvement is given in 
Sect. 5.2.2. 

Uncertainty influences the execution of all kinds of technical processes along the 
product life cycle, e.g. production processes or application processes. One possibility 
to uncover uncertainty is therefore to analyse processes with the aid of a generalised 
process model. Possible deviations can be attributed to system components in a 
standardised way and by this, uncertainty is disclosed reliably to a large extent. Such 
a generic process model and its application is depicted in Sect. 5.2.3. 

As discussed in Sect. 1.3, models can be useful, but at the same time have their 
limits. Reliable information sources can help to overcome these limits. But in many 
cases, relevant information cannot be gained directly in experiments. A conflict 
between accessibility and reliability has to be solved. In Sect.5.2.4 this challenge 
and possible solutions are presented for the domain metal forming processes. 

Mathematical models can also be used to uncover uncertainty during the design 
phase. The models can be based purely on physical laws (white box models) or on 
data (black and grey box models), cf. Sect. 1.3. Often, a large number of uncertain 
design variables has to be considered. In the case of stochastic uncertainty or incer- 
titude, information about the relevant domain of uncertainty is given, cf. Chap. 2. 
Due to time consuming calculations, white box models are difficult to compute for 
a representative number of possible combinations. Instead, fast models modelling 
based on surrogate models in Sect. 5.2.5 and demonstrate their usefulness for density 
and quantile estimation in Sect. 5.2.6. 

Product design does not only comprise the initial design but also design changes 
that become necessary later. This applies in particular to special purpose machines, 
which are built to fulfil customer specific requirements. With regard to these, it is 
indispensable to master uncertainty, if ignorance, see Chap.2, ultimately leads to 
clearly visible deviations from customer requirements. We propose a change pro- 
cedure in Sect.5.2.7, which helps to master uncertainty in these situations without 
jeopardising customer satisfaction. 


5.2.1 The Method of Uncertainty Analysis and Evaluation: 
UMEA 


Hermann Kloberdanz and Fiona Schulte 


In this section, the Uncertainty Mode and Effects Analysis methodology UMEA is 
presented, which we have developed for a comprehensive, consistent and uniform 
uncertainty analysis in the entire development process, cf. [86, 89]. Uncertainty 
occurs in all phases of the virtual and real product life cycle. In the virtual product 
life cycle mainly uncertainty in the specification as shown in Sect. 5.1.2, and model 
uncertainty, discussed in Sect. 2.2, cause deviations of the planned product proper- 
ties from expected properties. Products then do not fulfil the customer expectations 
regarding functionality, effort and availability. In addition, real products sometimes 
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do not meet the planned properties due to uncertainty that occurs in all phases of 
the real product life cycle and is propagated in the process chains. In both cases, the 
acceptance of the products decreases due to uncertainty and endangers the market 
success of the products, cf. [90, 142, 143]. 

Especially in the case of new developments, the virtual product life cycle is charac- 
terised by a lack of secure information. Especially the early phases therefore represent 
a typical situation of high uncertainty. The complexity, importance and criticality of 
the situation is explained in Sect. 5.2.2. There, in addition to the solution of the tech- 
nical task, the innovation and time pressure as well as the interconnectedness are 
emphasised. Misjudgements by developers regarding available resources, material 
properties or disturbance parameters contribute to uncertainty and can lead to critical 
system states in the later use phase, cf. [89]. 

The detailed analysis of uncertainty that can occur in the entire product life cycle is 
therefore a prerequisite for mastering uncertainty in the development of new systems. 
The uncertainty analysis has to be carried out from the beginning and throughout 
the entire development process. The results of the analysis act as a basis for sys- 
tem synthesis, e.g. by the robust design method [90]. However, previous methods of 
uncertainty analysis only consider a narrow range of the life cycle of a product [142]. 
The diverse influences in the individual life cycle processes and the propagation of 
uncertainty in the process chains as shown in Sect. 3.2 make it necessary to include 
identification and evaluation of uncertainty over the entire life cycle into the uncer- 
tainty analysis. 


Analysing uncertainty in development processes 


The term UMEA is an extension of ‘Failure Mode and Effects Analysis—FMEA’ [74]. 
However, the scope, consideration horizon and application range go far beyond 
FMEA. The UMEA is based on a procedure consisting of four phases. In addition 
to the identification of uncertainty and sources of uncertainty, e.g. by the method of 
technical process analysis that will be described in Sect. 5.2.3 in detail, the stepwise 
procedure for UMEA is oriented towards the main challenges of the mastering of 
uncertainty during the entire product development process: (i) uniform procedure 
for uncertainty analysis across all concretisation stages in the product development 
process, (ii) focus on critical product properties and uncertainty influences, (iii) con- 
sideration of the propagation of uncertainty in the product life cycle with regard to 
its effects in the usage phase. 

The stepwise procedure at UMEA comprises four phases shown in Fig. 5.8: (i) 
environmental and goal analysis, (ii) identification of uncertainty and its causes, (iii) 
determination of uncertainty effects, (iv) evaluation and decision. 

Product properties are characterised by an extreme amount, a high versatility and 
cross-linked uncertainty. The ‘environmental and goal analysis’ contributes to a pur- 
poseful focus on properties which are particularly critical with regard to uncertainty. 
The system is delimited from its environment and a system boundary is defined as 
depicted in Sect. 1.3. This is the prerequisite for distinguishing between external and 
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Fig. 5.8 Procedure at UMEA; process steps with associated models and methods following [90] 


internal influences and supports the determination of the causes of uncertainty. Fur- 
thermore, the evaluating parties (e.g. users, stakeholders, requirement groups) are 
identified and their value concepts are specified. This can be used to describe the 
expectations of the basic system properties (e.g. maximising the benefits and quality 
of the system usage, minimal life cycle costs). The tolerated uncertainty can also be 
documented in the technical specification as explained in Sect. 5.1.2. 

In the second phase, an identification of uncertainty and its sources will be carried 
out. For this purpose, the processes of the life cycle identified as relevant are analysed 
in detail and significant influences to uncertainty are identified, e.g. by a technical 
process analysis, as already mentioned above. 

In the third phase, uncertainty effects will be analysed. The existing relationships 
between external influences, the process parameters and the properties of the result 
of the process are specified and accumulated over the process chains of the entire 
product life cycle as comprehensively as possible. The deviations in the result of the 
process are mainly assessed based on the sensitivity of the individual processes with 
regard to the identified causes of uncertainty, see below in this section. 

In the fourth phase, the existing uncertainty is mostly assessed with regard to 
the usage processes. Depending on the level and probability of the accumulated 
uncertainty, a risk can be determined taking into account possible deviations from 
the expected system properties and the resulting consequences in the specific context 
of use. Based on this evaluation, a decision is made on adequate measures to master 
uncertainty in the system adaptation. The steps “evaluation of uncertainty and risk’ 
and ‘decision making’ can be combined into one phase for simplification as shown 
in Fig. 5.8. 
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The uncertainty mode and effects analysis methodology 


In order to meet the requirement of a comprehensive, continuous and uniform uncer- 
tainty analysis in the development process, the UMEA must be applicable at all 
levels of abstraction and depict the propagation of uncertainty in the product life 
cycle. UMEA therefore goes beyond the description of a single method and is ori- 
ented towards a modular concept. 

Models and numerous methods for mastering uncertainty have existed for some 
time, cf. [142]. So far, however, these have only been used isolated, referred to indi- 
vidual problems and not under the integrating aspect of mastering uncertainty. The 
UMEA methodology mainly combines these methods in a systematic procedure for 
a comprehensive uncertainty analysis during the entire development process. UMEA 
thus takes advantage of existing methods, but goes far beyond existing methods in 
terms of uncertainty analysis. 

UMEA’s analysis activities are supported by a collection of methods that can be 
combined according to the underlying procedure. The systematic mastering of uncer- 
tainty includes methods for identifying and describing uncertainty, for evaluating the 
criticality of uncertainty, and approaches to reduce uncertainty in the system design, 
cf. [89]. 

Of particular note is the combination of process models and matrix-based analy- 
ses to identify the sources of uncertainty and determine the consequences of uncer- 
tainty, cf. [86]. The detailed modelling of the single processes provides qualita- 
tive information about the relevant properties of the process’s initial states and the 
uncertainty-relevant influencing parameters during the process execution. Based on 
a sensitivity matrix, the interrelationship between uncertainty in the initial state and 
the uncertainty-relevant influences of the process parameters can often be described 
quantitatively, cf. [89]. 

For this purpose, the expected level and deviation of the influencing parameters 
on the process (e.g. disturbance parameters) and the operator (e.g. work equipment 
in a manufacturing process) are estimated. Depending on the information available, 
this is made quantitatively or qualitatively according to the uncertainty model. Fur- 
thermore, the deviations in the properties of the operand (e.g. partially manufactured 
component, initial state) caused by previous processes are estimated. The effect of 
the individual influencing parameters and the uncertainty of the process execution 
on the properties of the operand in the final state (e.g. dimensions and shape of 
the manufactured component, process result) are determined by means of sensitivi- 
ties. The consideration of interdependencies between the influencing parameters and 
effects requires a complex structure of the sensitivity matrices. The uncertainty of 
the process result are calculated quantitatively or at least qualitatively by adding up 
the partial deviations, cf. [86]. 

The modelling of process chains consisting of multiple processes forms the basis 
for quantifying the propagation and accumulation of uncertainty over the entire prod- 
uct life cycle. The properties including their uncertainty in the final state of a process 
form the initial state of the subsequent process. The uncertainty of the follow-up 
process can be calculated or estimated in the same way using a further sensitivity 
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matrix. Thus, the uncertainty of production processes is accumulated up to the usage 
processes. The accumulation of uncertainty does not necessarily lead to an increase 
of uncertainty. By defining the processes and their sequence, uncertainty can also 
be reduced by assigning optimised processes regarding uncertainty. These processes 
often show a low sensitivity to critical product properties. Uncertainty from previous 
processes can also be mitigated or even compensated for. Examples are the process 
sequences of drilling and reaming discussed in detail in Sect. 4.1.3. 


Applying the UMEA methodology 


For evaluation we have applied UMEA exemplary to design optimisation of a very 
simple tripod demonstrator representing a system for uniform load distribution. In 
this tripod demonstrator, three legs are symmetrically and parallel attached to a load 
distribution ring. The device is loaded by a mass. The load is to be evenly distributed 
on the three legs of the demonstrator, cf. [223]. The application of the UMEA is 
described in detail and discussed in depth in [87] and in [86]. 

In the first phase “environmental and goal analysis’ of the UMEA the even load 
distribution on the legs and the analysis of the influence of the tripod production 
is recognised as a goal. In order to exclude influences by eccentric tripod load and 
uneven or inclined ground contact area, these are included within the system bound- 
ary. 

In the second and third phase the ‘identification of uncertainty and their causes’ 
as well as the “determination of uncertainty effects’ are performed. The uneven load 
distribution in the legs is identified as the uncertainty to be optimised during use. In 
the example, different vertical distances between the load distribution ring and the 
contact area at the three legs, here referred to as ‘total leg length’, can be identified 
as the source of uncertainty. The further analysis shows that the ‘total leg length’ 
depends on the length dimensions of the leg components, which are influenced by the 
manufacturing process. Furthermore, a non-parallel and non-positional mounting of 
the legs during assembly influences the ‘total leg length’. 

In the ‘evaluation and decision’ of the fourth phase it is a recognised calculation 
that in the present system the length and the axial position of the leg components 
influence the uncertainty more than the angular deviation from the vertical attach- 
ment. Therefore, it was decided to develop different fastening designs. In the end, 
the design was selected that offers the highest manufacturing and assembly accuracy 
with respect to the leg length and position. 

By applying UMEA to a current conducting plug connector in the engine com- 
partment of an automobile, we have demonstrated that UMEA is in principle also 
applicable to more complex systems, cf. [86]. However, the disturbance influences 
by dirt, corrosion, vibration and temperature are a great challenge. The UMEA has 
contributed to mastering the uncertainty, especially by systematically incorporating 
the experience of the specialists. 
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Conclusion 


The UMEA methodology developed represents a cross-process uncertainty analysis 
that covers the entire life cycle of the physical product with a focus on production and 
usage. It enables uncertainty of the entire product life cycle to be comprehensively 
and specifically analysed and evaluated in the entire system development process, 
cf. [89]: 


e Methods are provided that can be used from the beginning in all phases of the 
development process with increasing degree of more detailed description. 

e Itis intended for use at a high level of abstraction as well as for very specific design 
phases. 

e In the analysis, the planned processes of the entire physical product life cycle are 
included and the propagation of uncertainty in the process chains is also considered. 

e A focus on relevant influences and deviations is made several times in order to 
master the extend and variety of uncertainty in the system development. 

e Finally, UMEA goes beyond an uncertainty analysis and provides prioritised infor- 
mation for mastering uncertainty in system design. 


In the modular concept of UMEA, well-known methods were adapted and comple- 
mented by special methods. UMEA links the different models and methods, each 
adapted to increasing degrees of concretisation, in a uniform procedure for the uncer- 
tainty analysis. 

A fully quantified analysis of uncertainty in all steps of the UMEA is usually 
neither possible nor reasonable. For a methodical analysis of an entire process chain 
during development, qualitative approaches need to be complemented by suitable 
quantitative analysis methods to an appropriate extent. If, for example, significant 
uncertainty in the production processes are quantitatively known, the uncertainty 
calculation can be done without a detailed analysis. 


5.2.2 Mastering Uncertainty in Product Development 
Peter Groche and Maximilian Knoll 


For the sake of improving product development, we present a method that takes 
user requirements into account while being independent of the product or personal 
experience. The methodology extends and improves existing approaches by taking 
comprehensively into account the roles for the design unit and the design process. 
Design engineers have to master numerous and distinct challenges in the mod- 
ern industrial environment. For this purpose, engineers work in close cooperation 
with specialists from various disciplines and with different skills [219]. In addition 
to conventional development methods, design engineers are increasingly working 
with agile development methods. In comparison to classical development meth- 
ods, the agile methods rely on a reduced set of planning and product specifications, 
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while at the same time strongly integrating customer feedback. Thereby, the skills 
and approaches of the designers must also be suitable for working in international 
teams. Due to increasing international division of labour, a reduction of in-house 
developments and a high effort for project management can be observed. In addi- 
tion to these tasks, design engineers interact with customers, suppliers and various 
departments of the company and have to accomplish communication and strategy 
tasks [81]. Furthermore, they bear a huge responsibility for society, customers and 
the company [21]. To fulfil these responsibilities, designers are supported by a wide 
range of methodologies. Despite the evolution of responsibilities, the primary task 
for designers remains to design functional, innovative, safe and sustainable products, 
cf. Chap. 2. However, professional experience so far has been an essential factor in 
managing the daily tasks [219]. The aim of the design tasks is to ensure that the 
products generate economic added value for the company. 

In addition to the expanded roles of responsibility, the product life cycle has 
changed due to the “frontloading” [164] and the shortened development times [250]. 
The frontloading approach shifts development decisions and activities to early stages 
of development, allowing challenges to be identified and saving development time. 
The frontloading and the shortened development times can partly lead to premature 
products and impact the customer satisfaction in an unfortunate way. This form of 
acceptance (cf. Sect. 1.7) can result in high losses and cause damages which are 
extended especially by merging mechanical, electrical and data processing solutions 
to the brand [13, 139]. Uncertainty is even more pronounced due to the simultane- 
ously increasing complexity of products. 

Thus, the application of suitable design methods is becoming increasingly impor- 
tant. However, current design methods focus on the design process and neglect the 
working environment. The working environment is determined by standardised CAD 
and PDM systems. Standardised CAD and PDM lead to a higher amount of available 
information. The use and usability of the available information depends strongly on 
the experience of the design engineer [47]. 

The economic and social changes introduced by industrial rationalisation and 
automation have led to the development of various methods and approaches which 
help to structure and simplify the design process. The step-by-step approach accord- 
ing to VDI guideline 2221 [269] is a universal but somewhat unpractical approach 
for the design of technical systems. In addition to VDI 2221, Birkhofer [40] gives a 
detailed overview of the design development that has taken place so far. However, 
the existing methods with their sequential structure do not represent real design pro- 
cesses [242], because they do not explicitly capture the iterative steps of product 
development. 

The method developed by Schmitt [241] is based on known problem-solving 
strategies and expands these by including the working environment. The primary 
objectives of product development remain the realisation of customer demands and 
the compliance with market requirements. In order to achieve these goals, the task 
of product development is to generate suitable product data [217]. For this purpose, 
three axioms are defined as basis for the following product development method 
[241]. The axioms are to be regarded as equally important for successful product 
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development and thus for the success of a company [241]. The three axioms are as 
follows: 


(i) Products are always developed under sustainable aspects. 
(ii) Decision-making and its comprehensible documentation in product develop- 
ment require the distinct definition of evaluation criteria. 
(iii) The development process is an iterative procedure that must be individually 
adapted to each task and is highly dependent on the involved stakeholders. 


A design unit as an organisational unit closely collaborates with marketing, sales, 
purchasing and production [85]. This strong integration into the corporate environ- 
ment results in complex influences on the product development process. In order to 
take these influences into account, the involved roles of operation are considered. 
According to [106], stakeholder groups represent groups or individuals who influ- 
ence corporate goals or may be affected by them. A differentiation is made between 
external and internal stakeholders. The specific roles of internal stakeholders, who are 
located within the company boundaries together with the design unit, are presented 
in more detail below. 

With regard to their contributions to the overall product development process, the 
internal stakeholder can be divided into two groups: (i) the first internal stakeholder 
group is responsible for the product definition. This includes employees from sales, 
distribution and marketing. They have in common that they develop and define the 
desired properties of a product in customer contact or on the basis of market data [41]. 
The second internal stakeholder group is involved in the product realisation depart- 
ment and in the product development process. This group includes all persons in the 
company who are involved in the implementation of the real product. This includes 
production, testing and purchasing. The management can be found in both internal 
stakeholder groups described above. This means that there is no separation with 
respect to technological and economic influences. 

In the general overview of the method by Schmitt [241] shown in Fig.5.9, the 
core tasks of the two stakeholder groups are divided into three roles: classification, 
decision and design. All roles benefit from the generated product data. 

As described in [241], the aim of the shown roles is to define all relevant goals 
resulting from the complex interaction between product components, stakeholders, 
expectation and the environment before the development process begins. Typical 
goals for the product development are, for example, functionality, time and cost 
requirements, cf. Sect. 1.1. The task of the internal stakeholder group “Product Def- 
inition” is to transfer the requirements and desires of the customer into dependent 
product properties and to communicate the goals during the process. The customer 
only recognises the dependent properties, whereas the design unit defines the inde- 
pendent properties and on the basis of this definition influences the dependent prop- 
erties. 

The design unit is responsible for the actual product development (Fig. 5.9 “cre- 
ate”). The design unit has to identify the independent properties relevant for achiev- 
ing the objectives. In consultation with the internal stakeholder group product real- 
isation, the properties must be compared with customer requirements and wishes. 
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Fig. 5.9 Overview of interactions between operation roles [241, 242] 


Based on the solutions developed in the Product Realisation department, the design 
unit prepares the decision-making process for the Product Realisation stakeholder 
group [241]. 

Decisions with great consequences for product development are decided, imple- 
mented and documented in the role “decide”. It should be noted that a distinction is 
made between the decisions of the design unit and those of the internal Product Real- 
isation stakeholder group. The comparison between the dependent properties with 
regard to the fulfilment of customer wishes and requirements is carried out during 
development activities. The product data compiled by the development unit repre- 
sents the result of the method and serves as the basis for evaluation in the respective 
iterations [241]. 

Depending on the results of the described comparison, a further iteration of the 
process might be necessary. If conflicting goals cannot be resolved the internal project 
group, the stakeholder group responsible for the product definition contacts the cus- 
tomer again. However, further iterations may result from a seemingly successful 
completion of product development. This is the case, for example, if the customer’s 
requirements are formulated in a misleading way or if they have been transferred to 
incorrect dependent properties. In this case, a closed loop is created which can be 
run through in an iterative manner during product development [241]. 

Through the iterative process and under consideration of the customer influence, 
the previous method can be extended to Fig.5.10. This results in a closed product 
development cycle, which represents the interactions between the individual stake- 


262 P. Groche et al. 


EY 
Į 


product definition C2 customer/s 


product realisation Caa m~~ nation & society 
II competitor 
suppliers H 
define 
A goals 
decision 
new 
process means 
= requirements | | tech. horizon a 
i 


Fig. 5.10 Interaction flowchart of the stakeholders according to [241, 242] 


holders. Stakeholders outside the company’s boundaries can open up new opportu- 
nities for the development unit. 

Potential examples are new or adapted solutions from suppliers. The government 
and the society, as well as competitors and external stakeholders are special because 
of their influences. The influence of all external stakeholders can lead to new goals 
as well as new opportunities for the design unit. On the one hand, the government 
certification of operating materials or the rejection of patent applications by competi- 
tors can create new opportunities for the design unit. On the other hand, new goals 
and requirements can be generated for the design unit due to laws, public interest 
in technologies, as well as pioneering products of the competitors. The depth of the 
technological horizon describes the technical and methodological knowledge of the 
development unit acquired over the years of professional activities. Examples are 
design specifications for components, detailed knowledge of machine elements and 
their possible applications. In order to obtain or generate the information required 
for the design, the development unit has two communication partners at its disposal. 
On the one hand, the internal and on the other hand the external stakeholders can 
be consulted for the absolutely necessary exchange of information. In case of high 
uncertainty due to limited information, it may be necessary to define new goals by 
communicating with the internal stakeholder group Product Definition. This influ- 
ences the requirements and thus reduces the needed effort [241]. 

Research on design methodology has been conducted for decades, resulting in 
different approaches and methods to support designers. Due to the changing condi- 
tions and requirements of products and markets, new approaches have been devel- 
oped and existing ones adapted. Nevertheless, there is a gap between the promises 
of academic methodological approaches and industrial reality. One reason for this 
is that methodological approaches in industry are so far perceived as inefficient. 
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Developing a method that extends the system boundaries of the design process to 
internal and external influences seems promising to update established approaches 
and move towards a dynamic, closed-loop system [242]. Therefore, the discussed 
method is based on specific participants in the product development process and their 
activities and responsibilities. The approach extends and improves existing ones by 
extending the system boundary to take into account influences on the design unit 
and the design process. Thus, the approach represents a possible solution to transfer 
industrial reality into a universal methodological approach. Preliminary analyses of 
the industrial application show that the method simplifies the task of the design- 
ers [241]. This shows how important it is to create a basis for a new generation 
of design methods [241]. By involving stakeholders in the development process, 
product expectations can be improved. 


5.2.3 Methodical Uncertainty Consideration in Technical 
Process Modelling 


Hermann Kloberdanz and Fiona Schulte 


In this subsection, the generic model of technical processes is presented, which 
we developed for the comprehensive identification of uncertainty in all phases of 
the product life cycle. A special feature of this universal model is the purposeful 
localisation of uncertainty and the sources of uncertainty. Thus, the model has the 
character of a reasonably structured checklist and provides basic advice on effective 
approaches to reduce uncertainty. 

As presented in Chap. 1, acceptance describes the fulfilment of expectations of 
a product or component in terms of functionality, availability and effort. However, 
acceptance is not a characteristic of the product in the narrow sense, but matters 
only in connection with the process steps. This applies to the process steps of all 
life cycle phases, e.g. in product development with regard to the planned properties, 
in production with regard to manufacturing tolerances, or in usage with regard to 
performance and efficiency. 

Additionally, the term uncertainty covers both, the measurable or perceptible 
uncertainty of a product, and the causes why uncertainty arises in the entire life cycle 
of a product, cf. [143]. Consequently, the analysis of process steps has to identify and 
locate the sources of uncertainty, the emergence of uncertainty, and the propagation 
of uncertainty. Therefore, modelling the technical process steps in the product life 
cycle in detail has a key role in mastering uncertainty. 


Mastering uncertainty in life cycle processes 


A process step, here called process in simplified terms, can be considered in the 
context of technical systems in principle as a time dependent transformation of an 
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operand from an initial state to a usually changed final state, cf. [72, 272]. The 
model of technical processes developed by Heidemann has proven convincingly to 
be the most suitable model for describing processes from a large number of different 
models, cf. [149]. In the following, the generic model and the specified models of 
technical processes derived from it will be referred to as process model for simplicity 
reasons. 

It can be stated as common sense that the properties of products cannot or cannot 
completely be determined in both, the virtual and the real product life cycle, cf. [143]. 
The sources of uncertainty can be located in all life cycle phases. However, previous 
approaches to manage uncertainty are mostly based on an isolated consideration 
of uncertainty. The robust design approach of Taguchi, see Sect.3.5, for example, 
primarily refers to the production of products, cf. [257, 258]. Taguchi implicitly 
assumes that the properties of the manufactured product, which have been planned 
during the development phase, correspond to the current expectations of the customer 
and that the product is used as intended. Further, he concentrates on the quantification 
of deviations in the final state of the process steps without analysing the causal 
influences in a well-founded structured model of the system. 

In contrast, our comprehensive approach to the analysis of uncertainty is based 
on the modelling of processes that can be linked to process chains (or networks). 
In addition to the analysis of the result of a process step, the overall mastering of 
uncertainty in product development requires the identification of all possible sources 
of uncertainty in this process step. Therefore, in addition to the uncertainty of the 
system elements themselves, various external influences on the system that can cause 
uncertainty must be considered. Only two typical examples out of a huge number 
are thermal deformation of machine tools during production and pollution during the 
system’s usage. 

In order to be able to consider the sources of uncertainty, we have further developed 
the Heidemann process model for a comprehensive uncertainty analysis. Therefore, 
we have integrated all elements and the linking influences into the process model, 
which are relevant for the analysis of uncertainty in processes, cf. [175]. The generic 
process model is shown in Fig. 5.11. 

In this process model systems are basically represented by the process itself, 
the initial and final state of the operand, the work equipment and the relationships 
between them. The modelling is particularly illustrative in production processes in 
which, for example, a more or less finished part is produced from a semi-finished 
material (operand, initial state) by a forming process. If, for example, a servo press is 
used for forming, it is modelled as a work equipment that starts the process by means 
of working factors e.g. the ram force and ram motion, cf. Sect. 3.6.3. Additionally, the 
system environment (e.g. buildings, adjoining systems, nature), necessary resources 
(e.g. power supply, coolant) and user (e.g. operator) as well as their relations to the 
system are represented. Uncertainty regarding the result of a process step is modelled 
by the deviations of the properties and state variables of the operand in the final state. 

In the example of a forming process these are e.g. dimensional and form deviations 
of the manufactured part. Uncertainty of the process result can be caused by influences 
of all other elements of the process model and their interdependence. To support the 
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Fig. 5.11 Process model for the detailed analysis of uncertainty in processes following [175] 


mostly complete identification of the sources of uncertainty, the process model can 
be used as a kind of checklist. The process model is mainly used in the early phases 
of system development. It initially serves developers to identify essential design 
parameters and to describe uncertainty qualitatively, when assessing robustness of 
working concepts based on physical effects. This is discussed later in Sect. 6.1.5. 


Identification and location of uncertainty using the process model 


The main purpose of process modelling for the mastering of uncertainty is (i) the 
largely complete identification of uncertainty and sources of uncertainty and (ii) the 
reasonable and sense-attributing location of the sources of uncertainty. According 
to their localisation in the process model, groups of typical sources of uncertainty 
can be identified. We recognised three groups having characteristic properties with 
respect to mastering of uncertainty: (i) all elements inside and outside the system 
boundary, (ii) planned functional interaction inside and outside the system boundary, 
(iii) unintended influences between all elements inside and outside the system bound- 
ary. Additionally, the effective direction of the interactions and influences have to be 
considered, e.g. disturbance parameters of the environment on the work equipment 
and emissions of the work equipment on the environment. 

In the following, an overview of the utilisation of the process model is given. Tak- 
ing the example of the Modular Active Spring-Damper System (MAFDS) described 
in Sect. 3.6.1 the identification of potential uncertainty is illustrated only very briefly 
and exemplarily. If necessary, reference is made to the aircraft landing gear or vehicle 
running gear approximated by the demonstrator. First, the usage process is consid- 
ered. The special features regarding other life cycle processes are added afterwards. 
The description is focused on the groups of typical sources of uncertainty. 
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Process elements (operand, initial state, final state, process, work 
equipment) 


The MAFDS simulates the support of the aircraft on ground contact during landing 
by decelerating a falling mass by a supporting load bearing system, when it hits 
the foundation. The forces to be transmitted are comparable to driving over a road 
unevenness. In the example of the MAFDS test setup the loading mass is modelled as 
an operand, which represents, for example, the partial mass of a vehicle or aircraft. 
The initial state is described by the properties and state variables of the operand. 
In case of the demonstrator, these are mainly the properties mass and weight and 
the state variables direction and speed of the movement of the mass. The process 
represents the deceleration of the mass on contact with the ground, which can be 
described as a time-dependent course of movement. The final state defines the result 
of the process. When planning usage processes, the final state usually represents 
the expected result of the process. In the demonstrator, the final state is essentially 
described by the position of the mass. In case of a running gear, the deceleration 
values of the operand are mainly decisive for the user. Acceleration values that are 
not or not fully accepted by the user, e.g. for reasons of comfort or safety, represent 
the uncertainty of the process result. 

This differentiated consideration highlights the fact that, in contrast to the work 
equipment, the developer can only influence the properties of the operand, the pro- 
cess, the initial state, and as a consequence, the final state, all of which depend on 
the usage of the system to a limited extent. Since they cannot be determined, they 
represent a high degree of uncertainty. In the case of usage processes, the corre- 
sponding uncertainty can be mastered more or less only in the development process 
by a carefully and detailed technical specification, cf. Sect.5.1.2. Since the initial 
state is significantly influenced by the preceding process step, cross-process analysis 
is very important in production processes. In Sect. 4.1.3 and later also in Sect. 6.1.8, 
this is illustrated by the example of drilling and reaming, where the uncertainty of 
the initial state during reaming can be influenced to a certain extent by the preceding 
drilling process. 


Resources and inputs of work equipment 


After ground contact, the MAFDS is supported on the foundation of the test setup. The 
supporting forces, or in a broader sense the foundation including the impact surface, 
are modelled as resource in the process model. Thus, it represents, for example, the 
condition of the road surface when looking at a chassis. Time-dependent deviations 
of the contact area in displacement, position, and especially in direction represent 
the uncertainty of the resource. For the simulation of uncertainty in the test setup, 
impact surfaces with different angles are provided. This allows analysing effects of 
an uneven road surface on running gears. 

In many cases, as for example here with the running gear, the resources can 
practically not be influenced by the developer. The corresponding uncertainty can 
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only be mastered by elaborating the technical specification and designing the work 
equipment accordingly, see Sect. 5.1.2. In the case of stationary production processes, 
there is usually a much smaller uncertainty regarding the supply of energy. It can be 
mastered either by choosing an energy source with low uncertainty or by additional 
measures, such as buffer storage. 

Operator inputs mainly represent the operation of the work equipment. Operat- 
ing errors often represent a considerable uncertainty, which is sometimes extremely 
difficult to master, especially in active systems. In a similar way to other resources, 
input uncertainty can be managed by reducing the volume and complexity of the 
inputs required. For example, a high degree of automation of work equipment usu- 
ally reduces the uncertainty of operating errors. In case of the MAFDS, operator 
influences are limited to the triggering of the drop test. Thus, uncertainty of the 
operator is negligible here. 


Unintended influences between all elements of the process model 


The work equipment unintendedly interacts with the system environment, the oper- 
ator and the resources. The modelling of the corresponding relationships represents 
on the one hand disturbance parameters on the work equipment, on the other hand 
side effects, which are caused by the work equipment, cf. [192]. For the MAFDS, 
disturbances and side effects are of minor importance, since it is shielded and oper- 
ated in a low disturbance laboratory environment. In the case of represented landing 
gears or vehicle chassis, temperature and radiation influences, chemical and mechan- 
ical influences, as well as pollution can occur from the environment as disturbance 
parameters that can impair the function of the work equipment. 

Conversely, the work equipment also generates side effects, which usually have 
a negative impact on other system elements in form of emissions, e.g. neighbouring 
systems or components. In the case of represented landing gears or vehicle chassis, 
for example, abrasion, noise and vibrations can have an environmental impact, a loss 
of comfort for the passengers (users) and a friction value-reducing effect on the road 
surface (resource). The side effects are often not acceptable and are perceived as 
uncertainty, cf. [175]. The process model thus indicates that disturbance parameters 
can be mastered by eliminating them or taking measures to reduce their influence, 
cf. [192]. Corresponding design strategies are discussed in detail later in Sect. 6.1.5. 

Interactions between work equipment and process are, in principle, comparable 
to disturbances and side effects, and can be identified in a similar way; but they have 
a different quality. Corresponding sources of uncertainty are usually more difficult 
to master due to the close interlinkage of process and work equipment within the 
system boundary. Typical and critical cases are, e.g. soiling or contamination of food 
processing systems, cf. [22]. 
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Conclusion 


The process model is apparently a very simple generic model. The described analysis 
with the help of the process model impressively shows the complexity in scope and 
diversity of the resources of uncertainty. By classification and meaningful localisation 
in the process model, useful advice for the identification and design of robust and 
resilient solutions can be derived. 

The findings and results of a process model analysis can be documented in the 
technical specification that serves as a basis for the subsequent system synthesis, 
cf. Sect.5.1.2. Thus, the process model analysis is indirectly a purposeful basis for 
the later mathematical modelling and simulation of the systems. 

When looking at production processes, the process model assist engineers to 
identify and locate uncertainty equally. It is very important to realise that in con- 
tradiction to usage processes in production processes the parts and components of 
the load-bearing systems are modelled as operands and the machine tools as work 
equipment. 


5.2.4 Conflicting Objectives in the Determination of Process 
and Component Control 


Peter Groche and Maximilian Knoll 


The quality of products is one of the most important requirements in production 
technology. Fluctuations in semi-finished products and the forming process can influ- 
ence the quality of products in a wide range, cf. Sect. 1.7. In addition to known and 
unknown uncertainties (Sect. 2.2) in production processes, the influence of ecologi- 
cal and economic effects on production technology is increasing. Furthermore, the 
forming processes are influenced by known uncertainties, such as temperature, tools, 
machines and lubricants. Especially in the last three phases (cf. Sect. 6.1.5) of the 
design process (cf. Sect. 1.2), sensors can be integrated cost-effectively at optimal 
measuring positions in tools as well as machines. The subsequent integration of sen- 
sors proves to be cost-intensive and difficult, depending on the required measurement 
quality. In order to consider the correlation between sensor position, costs, measuring 
uncertainty and product quality in the phase of the design process, a model for evalu- 
ation is presented and discussed using the example of the 3D Servo Press (Sect. 3.6.3) 
and conventional forming processes. 

The most important semi-finished product properties in sheet metal forming are 
usually sheet thickness, yield strength, anisotropy and surface properties, as these 
influence the process and recovery behaviour [191]. In order to reduce product uncer- 
tainty, narrow tolerances for semi-finished product properties are therefore required. 
As a result, the testing effort, energy consumption and manufacturing costs increase 
during the production of semi-finished products. Another approach is the closed- 
loop control of product properties to make the process insensitive to process fluc- 
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Fig. 5.12 The target diagram, given by [56], using the example of the measurement positions of 
the 3D Servo Press 
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tuations (Sect. 1.3). This requires all the components of a closed-loop control (see 
also Sect.5.3.2), which consist of sensors, state observers, controllers and actua- 
tors [243]. Thereby the position of the sensors is important for the closed-loop quality 
control [126]. We refer to [56] for a literature review on special measurement and 
control approaches which are relevant for this topic. Due to the high relevance of 
the measuring position, it is important to consider the sensor position in the product 
development process to quantify uncertainty, as it has been done with the example 
of the 3D Servo Press (Sect. 3.6.3) in the change process (Sect. 5.2.7). Therefore, a 
method for the representation of the spatially opposite degree of interest in knowledge 
of a measurand and its measurability in the form of the target diagram in Fig.5.12 
was presented [56, 59, 122]. 

The target diagram of Calmano [56] shows possible measuring positions for the 
determination of machine, process and component parameters. For the example of 
a forming machine, the system is subdivided into the frame, drives, fixture, guides 
and clamps. A further subdivision is made for the tool, which is not directly a part 
of the forming machine. The innermost circle is further divided into the areas tool, 
product and the forming zone. By a symbolic evaluation from low (-) to high (++) 
(compare Fig. 5.12), an estimation of the measurability and the possible interest of 
the respective measuring position is possible. In the direction of the centre of the 
target diagram (Fig.5.12), the knowledge gain of the measured technical/physical 
quantity increases, which reduces sensor uncertainty. The measurability, however, 
decreases for most physical quantities towards the centre of the target and proves 
to be most technologically challenging in the component. Compared to the forming 
zone, measuring positions, such as the frame and drives, are already equipped with 
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Fig. 5.13 Challenges of sensor integration with time consideration [59] 


conventional measuring equipment by default or can be realised with only minor 
technical and financial hurdles [59]. 

With regard to the time sequence of the forming process it can be seen that many 
product properties are still changing during the recovery phase after the forming 
process and therefore cannot be measured directly in the process. These relations 
increase the uncertainty for control systems. For this reason, Fig. 5.12 can be extended 
by the time-dependency (Fig. 5.13). 

An example of the time dependence of product properties is the resulting angle 
in a bending process. As long as the forming tool is in workpiece contact, the final 
bending angle cannot be measured. Only after the tool is no longer in contact with the 
workpiece, the stored elastic energy is released until a stress equilibrium is reached. 
Afterwards, the final bending angle can be measured. The recovery phase leads to the 
problem that even with successful sensor integration in the forming zone, the final 
product properties cannot be measured during the process. For this reason, control 
engineering uses condition monitors which, for example, instead of the bending angle 
provide indirect information about machine and tool variables, such as positions, 
speeds and reaction forces [59, 122]. 
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In conventional press development, it is common practice to determine the press 
force by the frame elongation. In the target diagram (Fig.5.12), the measuring posi- 
tion is at the outer ring. The geometry of the frame has a significant influence on 
the elongation, so that a calibration of the sensors is necessary. Calibration is carried 
out by applying known forces to the ram. Subsequently, mathematical models can 
be used to derive the desired measured variable (Sect. 1.3). During process operation 
it is possible that eccentric forces act on the ram by combining different forming 
processes, which were unknown in product development. Uneven process forces 
lead to unwanted ram tilting due to machine stiffness. This is accompanied by the 
possibility of a secondary force flow. This means that during process operation, there 
is a possibility that the occurring forces are not measured with sufficient accuracy 
and therefore the process has a high unknown uncertainty. 

For this reason, the force measurement on the 3D Servo Press was shifted towards 
the centre of the target diagram (Fig.5.12). In addition, the 3D Servo Press has a 
large number of sensors compared to conventional presses. The measurement of 
the force is realised by strain sensors similar to conventional presses. To reduce the 
unknown uncertainty, the strain is measured in the direct force flow of the kinematics 
at the drive rods (see Sect.5.2.7). Due to the rotationally symmetrical drive rods, 
three strain sensors are installed per drive rod. This ensures that the most accurate 
force measurement possible is obtained even if the actuator stem is deflected. In 
order to realise a displacement control in addition to the force monitoring or force 
control of the press, displacement sensors with a minimum resolution of 2 ym are 
also integrated in the press, making it possible to reduce the uncertainty. These are 
located on the so-called “bearing frame”, which is responsible for the force guidance 
and displacement of the slide in the frame. The selected positioning reduces the 
influence of bearing play and friction losses caused by the main gears. In addition to 
the sensors close to the process, the sensors of the eight servo motors are available 
for control. The motor torque and the angle of rotation can be determined in the 
motors. Due to the different measuring positions, it is possible to draw conclusions 
on the machine status, for example, in addition to control engineering applications, 
Sect. 4.2. Due to the additional degrees of freedom and the integrated sensors of the 
3D Servo Press, the number of additional actuators and sensors required for flexible 
forming tools can be minimised, which is associated with a reduction in tool costs. 
The integration of the sensors and the selected measuring position affect the control 
quality [56] and thus the uncertainty. Therefore, the selection of a suitable control 
concept is important. Calmano [56] has developed a method for this purpose using 
different forming processes, which can be used to select suitable control concepts 
under consideration of economic aspects. 

There is a conflict of aims between quality and productivity in a production sys- 
tem of forming technology under the premise of improving the economic efficiency 
through cost reduction and revenue increase. The methodology shown above reduces 
the uncertainty for the selection of the control system. The approach is a control of 
component properties in the process, whereby the expenditure for their implementa- 
tion is set in relation to the contribution margin increase by means of investment cost 
calculation. The concept variants of the control approaches are created by synthe- 
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sis of different measuring, determining and influencing the defined target variables. 
The analysis of the concept variants with regard to quality is done by an uncer- 
tainty analysis of the designed overall system. Process sequences and reject rates 
are taken into consideration for the analysis of productivity. The expenditure for the 
implementation of the concept variants is estimated on the basis of development 
and failure costs as well as purchased components. The economic evaluation corre- 
lates these variables by means of investment cost accounting and identifies the most 
economically advantageous concept variant [56]. 

Especially with small quantities and frequent product changes, the cost of tool- 
integrated actuators and sensors is a significant factor in tool costs, which is why 
they must be taken into account in product development. This results in a conflict of 
objectives between accurate measurement of the target value with a low uncertainty 
for closed-loop control and economic efficiency. When integrating sensors, the use of 
the shown methods plays an important role in the economic implementation of new 
measuring systems. The example of the 3D Servo Press shows that the transfer of the 
tool actuators and sensors to the forming machines enables an improved measuring 
strategy with simultaneous economic advantages. As shown, the selection of suit- 
able measured variables, influencing variables and control concepts for the control 
of product properties, however, is still dependent on the process used, taking into 
account the economic and technological advantages and disadvantages. Therefore, 
these process-specific parameters have to be analysed depending on the process and 
evaluated under the mentioned influencing variables. The shown methods open up 
new possibilities for digitalised production. 


5.2.5 Estimation of Surrogate Models 
Sebastian Kersting and Michael Kohler 
Introduction to surrogate models 


Experiments with technical systems are often described by mathematical models. 
Such models, implemented as computer code, enable the use of so-called computer 
experiments, i.e. the experiment is simulated via a computer program using the 
underlying mathematical model. Thus, the technical system can be analysed by using 
computer experiments instead of real experiments. The mathematical model is given 
by a function m: R? — R, which models the functional relation between the d- 
dimensional input of the experiment and its real valued output. An overview on 
the design and analysis of such computer experiments can be found in Santner et 
al. [232] and Fang et al. [99]. Often these computer programs are complex and thus 
computational expensive to evaluate, but to properly analyse the experiment it is 
necessary to generate a large sample of computer experiments. To circumvent this 
problem, surrogate models can be used, cf. e.g. [15, 119, 166, 281]. A surrogate 
model is an estimator of the computer experiment m, which usually is much faster 
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to evaluate. Thus, they can generate a large sample of computer experiments. A 
rather general method to estimate a surrogate model based on a max-min approach 
is described in this section. Finally, we illustrate its usefulness on the digital twin of 
the MAFDS, Sect. 3.6.1, as described in [15]. 


Mathematical setting 


The method described in the following is based on the following mathematical set- 
ting: 

Let X, X1, X2, ... be independent and identically distributed random variables 
with values in R’, and letm : R — R be a measurable function. Here, X is the input 
variable of an experiment with the technical system and m is a computer experiment 
associated with the experiment with the technical system, where m(X) describes the 
outcome of the computer experiment. Given the data set 


(X1,m(X1)),..-, (Xn, m(X,)) (5.1) 


of size n € N, the aim is construct an estimator m,, the surrogate model of m. Typi- 
cally the data uncertainty in this case can be classified as stochastic data uncertainty 
as described in Sect. 2.1.1, but the method can also be applied in the other classes of 
data uncertainty described in Sect. 2.1.1. 


Estimate a surrogate model based on a max-min approach 


In most cases computer experiments are deterministic, i.e. for a given input X the 
result is always the same. Thus, instead of using the typical least squares approach, 
the surrogate model is defined as the minimiser of the maximal absolute deviation, 
i.e. it is defined by 


m„(-) = argmin. max, | f (Xi) — m(X;)|, (5.2) 


fern teils... 


where F, is a set of functions. In other words, to construct the surrogate model a 
class of functions F, is chosen and then a function f: R? —> R is selected from 
this set, such that the empirical maximal deviation is minimised. A possibility to 
compute this estimate is to use nonlinear programming, e.g. gradient descent [231] 
or Levenberg-Marquard [201]. Here, one has to neglect the fact that the gradient 
of (5.2) does not exist and use a numerical approximation of the gradient instead. 

Which class of functions to use depends on the particular setting and the dimension 
d. Usually, if the dimension is not too big, B-splines can be applied as shown in [14]. 
If furthermore the input X is deterministic and the input dimension is small, a quasi- 
spline approximation should be used as discussed in [92]. 
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In case of a large input dimension one possibility is to use neural networks, since 
they are usually able to achieve good results by circumventing the so-called curse 
of dimensionality as discussed in [176]. Below we will introduce a special class of 
sparsely connected neural networks, especially designed for computer simulations 
built in a modular way. We use them to estimate a surrogate model of the MAFDS, 
Sect. 3.6.1 and finally discuss the usefulness of this approach. 

In a first step the so-called spaces of hierarchical neural networks with parameters 
K, M, d*, d and level l are defined as follows, see [14]. Leto : R —> R be the so- 
called logistic squasher o (x) = 1/(1 + exp(—x)) (x € R). 

For M €e N, d e N and d* € {0,...,d}, we denote the set of all functions 
f: R! > R that satisfy 


(M+1)" d 


d* 
fœ) = 5 Mio Sse (Sein torsa) + hio | + Ho 
i=l j=l 


v=1 


for some Hi, Ài j, Oi jv € R, by Fa where x‘) denotes the v-th component of 
the vector x. 
For £ = 0, the space of hierarchical neural networks is defined by 


0) = _ gNN) 
Hx Md.d* = FMa 


For £ > 0, define recursively 


K 
Hi wag = fn: R? > R, h(x) = X gelfi), 2, fark(&)) 
k=1 
for some g% € FR and fix € ee (5.3) 


Kohler and Krzyzak [176] introduced these classes of hierarchical neural networks 
as an approximation for so-called hierarchical interaction models. We do not explain 
the advantages of hierarchical interaction models at this point, but we want to remark 
that this class of functions is a realistic assumption on technical systems built in a 
modular way. 


Application to data of the MAFDS 


We apply the surrogate estimator based on neural networks to a computer simulation 
oftheMAFDS (cf. Sect. 3.6.1). In the computer experiment a Modular Active Spring- 
Damper System is guided on a frame and falls down on the base of the frame. Virtual 
sensors allow the measurement of different parameters, such as acceleration, absolute 
position of the Modular Active Spring-Damper System, or the forces at the point 
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Table 5.1 Parameters of the N (u, o)-distributions of the input variables of the MAFDS in this 
computer experiment 


System property H o 
Spring stiffness N/m 27000 1200 
Damping constant N s/m 140 7 
Mass of spring support kg 20.35 0.25 
Mass of sphere in lower truss | 0.76 0.03 
structure kg 

Mass of sphere in upper truss | 0.76 0.03 
structure kg 

Mass of crosslink in upper 13.74 0.5 
truss structure kg 

Mass of threaded rod in truss | 0.363 0.015 
structure kg 

Mass of joint middle part kg | 0.9236 0.05 
Mass of joint arm kg 1.46 0.075 


of impact. In the simulation, the correlation of the nine normally distributed input 
variables presented in Table 5.1 on the computed output variable, the maximum force 
at the point of impact, is analysed. 

The computation of a single output value, during which a differential-algebraic 
equation system must be solved by the procedure RecurDyn of the software Siemens 
NX, takes about three minutes in this setup. Based on n = 250 generated realisations 
of the nine-dimensional input distribution and the corresponding observed outputs, 
we estimate the neural network surrogate model defined by (5.3). 

The estimate is computed by using nonlinear programming, to be exact the 
Levenberg-Marquard method, where the parameters K, M, d* and £ will be selected 
data dependent from fixed sets. The neural network parameters are chosen by a 
splitting of the sample, where we use n, = [2/3 - n] training data and the remain- 
ing n — n, data points as testing data. We use the fixed sets K e {1,..., 5}, 
M e {0,...,12},d* € {1,...,d}and £ € {0, 1, 2}. Since (5.2) is not differentiable, 
we generate a starting point by the approximation of a least squares approach first, 
and then use the Levenberg-Marquard method with a numerical approximations of 
the Jacobian matrix. 

This surrogate model is able to compute 10000 output values in less than one 
second. Using this surrogate model it hence becomes possible to generate a large 
sample of computer simulated values, which will be used in the application of the 
methods in Sect. 5.2.6. 
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5.2.6 Density and Quantile Estimation in Simulation Models 
Sebastian Kersting and Michael Kohler 


In an early stage of the development, usually no prototype of the technical system 
is available, and thus computer simulations of the experiment with the technical 
system are used to analyse properties of this technical system. Often quantifying 
the distribution of the outcome of an experiment is the focus of the method, since 
the outcome often determines properties of the system, which can be used in the 
design. To quantify the distribution of the outcome of the experiment we describe a 
method to estimate its density, and a method to estimate quantiles of the distribution. 
In Fig. 3.2 of Sect. 3.1 the method is assigned to the product or system design phase 
(A). 


Introduction 


Constructing prototypes of technical systems is often expensive and time consum- 
ing. Thus to reduce the effort, one can use physical knowledge of the system to 
implement a computer simulation m: R — R based on a mathematical model. 
This model describes the functional relationship between the d-dimensional input X 
of an experiment and the real valued outcome of an experiment Y. For example, if the 
technical system is a spring damper, then the input could be the drop height, payload 
and the spring stiffness and the outcome could be the maximal compression of the 
spring damper. Usually these computer models do not perfectly describe reality, but 
in an early stage, if no or only a small sample of real experiments are on hand, it is 
usually beneficial to assume that the underlying computer model fits reality perfectly, 
i.e. 

m(X)=Y (5.4) 


holds. To construct an estimator of the above mentioned characteristics of the dis- 
tribution of Y, a large quantity of computer simulations is needed. In this context, 
surrogate models as described in Sect.5.2.5 are playing a crucial role to generate 
these samples. In the following, we will present two methods to quantify uncer- 
tainty, more precisely, we will describe a method to estimate the density of Y anda 
method to estimate quantiles of Y. 

Both methods assume that either the underlying distribution of X is known, or 
that a large sample of input values is available. In reality this is often not the case. But 
often the distribution of the input variable is easily estimated since the randomness in 
the inputs is often induced by measurement errors or production tolerances. To apply 
the methods below it becomes then necessary to estimate the underlying distribution 
and generate a sample of input values based on this estimated distribution. For a 
multivariate normal distributed input variable, one can use the method described as 
in Sect. 4.3.8. An overview of methods to generate a data set based on a specific class 
of distribution can be found in Devroye [77]. 
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Mathematical setting 


All of the methods discussed below use the following setting: Let m: R? > R be a 
measurable function with m(X) = Y and assume that the data set 


(X1,Yı),..., (Xn, Yn), Xntis+++, Xntn, (5.5) 


where n, N, € N is available. According to Sect. 2.1 the uncertainty in the data can 
be classified as stochastic data uncertainty. Let g: R —> R be the unknown density 
of Y w.r.t. the Lebesgue measure which we assume to exist. 


Adaptive estimation of a density based on surrogate models 


In this and the next section, two methods of uncertainty quantification based on 
surrogate models are presented. A detailed overview of estimating surrogate models 
can be found in Sect. 5.2.5, hence we will neglect how to estimate surrogate models 
in the presentation below. 

We assume that a surrogate model m, of m estimated on (X,,m(X})),..., 
(Xn, m(Xn)) is already constructed. Based on this surrogate estimate we will present 
a method proposed in [101]. Firstly, choose N; € {1,..., Na — 1}, and denote 
N, = N, — N;. Next, define the density estimator based on the learning data N; 
and depending on a bandwidth h > 0 and a kernel function X: R— R by 


N} 
m 1 Y — Mn(Xn+i) 
= — K|I 5.6 
na) = HL ( 7 ) (5.6) 


and define the corresponding empirical measure on the test data by 


le 
ün,(A) = N > Ta(my(Xn4n,4i)) (A CR), (5.7) 


i=1 


where 74: R — {0, 1} is the indicator function which takes value 1 on A and is 0 
elsewhere. 

Finally choose a finite bandwidth set Py, C (0, oo) and define the data-driven 
bandwidth choice by 


hy, = argmin sup 
heP Nn AcAn,, 


f 8n.n(y)dy — Ân, (A)|, (5.8) 
A 
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where 
An, = Ib ER: Ên, m O) > Ên, m O)} : hi, h2 € Pr] (5.9) 


and define the estimator of the density g by 2 N. 


h Nn 


Monte Carlo quantile estimator based on surrogate models 


As before it is assumed that a surrogate model m, of m estimated on (X1, m(X1)), 
...,(X;,, m(X,)) is already constructed. Then the most simple way to construct an 
estimator Gm,(x),N,,« Of the a € (0, 1) quantile gy. of Y defined by 


dy. = inf {y E€ R: G(y) = a} (5.10) 
where G is the cumulative distribution function of Y given by 
Gy) =P{Y < y}, (5.11) 


is a Monte Carlo estimator. As in Enss et al. [92] or Kohler and Krzyzak [177] the 
estimator is defined by 


Gm. = inf [y ER: Gm. O) = 0}, (5.12) 


where 


N, 
i 1 
Gm, (Nu) = may): (5.13) 


" j=l 
Note that this is equivalent to choosing the [ N, - a] biggest values of m,(Xn+41),-- -, 
my (X n+N, ). 

This method is a straight-forward Monte Carlo approach. A more complicated 
and thus in many cases more exact method can be found in Kohler and Tent [178]. 


Application to data of the MAFDS 


As an application to illustrate the two methods described above we use the computer 
simulation of the MAFDS as described in Sect.5.2.5 and use the same method to 
estimate a surrogate model as described in this section. To estimate the density by the 
above described adaptive approach we use N, = 104 realisations evaluated with the 
surrogate model. The finite parameter set Py, is set as (2':le {—5, —4,..., 10} 
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Fig. 5.14 Adaptive surrogate density estimator, defined as in (5.6), based on a sample of 10* real- 
isations 


Table 5.2 Estimated quantiles Gm, (x),N,,a,defined as in (5.12), for the maximal force 


a 0.5 0.9 0.95 0.99 
Quantile estimate | 38148.75 38507.09 38600.71 38765.67 
inN 


and as kernel we use the Epanechnikov kernel defined by K (y) = (3/4) - max{1 — 
y?, 0}, where (x), equals x for x > 0 and 0 otherwise. The result is displayed in 
Fig. 5.14. 

The estimated density and quantiles can now be used for further development and 
to analyse properties of the technical system. 

Since the calculation of the quantile estimate is much faster we use N, = 10° 
realisations in this case. We use these realisations to calculate the 0.5, 0.95, 0.98 and 
0.99-quantiles as described in Sect. 5.2.6. The result is summarised in Table 5.2. 
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5.2.7 Mastering Uncertainty in Customer-Integrated Change 
Management 


Daniel Hesse, Maximilian Knoll, and Peter Groche 


Long-term competitiveness of companies that manufacture individual products can 
only be ensured by a continuing increase in efficiency, an accelerated process chain 
and company-wide learning [252]. Efficient processing involves a low use of enter- 
prise resources with the best possible product quality. The customer-integrated 
approach of the metalworking industry is already helpful, but customer integration 
would be necessary to be even more competitive [171]. 

A section within project management where integration is a very promising 
approach is engineering change management, since this currently requires large 
resources. These processes often involve unforeseeable changes. Dealing with these 
changes leads to uncertainty regarding the impact in terms of time, cost and quality 
of the product. 

The avoidance and efficient handling of change processes are important factors to 
mastering uncertainty. Baumberger points out that customer-specific developments 
of capital goods, such as the 3D Servo Press, in many cases have company structures 
that are strongly oriented towards individual development and production, which 
offer further potential for optimisation during the development process [17]. If a 
change is detected at a late stage of the product development process, this not only 
affects the product, but also has a significant impact on the costs of implementing 
the change. In this context the Rule-of-Ten approach is used in numerous studies 
(see [63, 141, 229]). The Rule-of-Ten describes the disproportionate increase of the 
change effort depending on the change time [16, 64, 107]. Here, the change-costs 
increase exponentially with each phase of the life cycle by a “factor ten” [108]. 

The temporal distribution of the changes that actually occurred additionally 
increases the cost share of the changes in relation to the total project costs. According 
to a literature-based analysis by Bauer [16], three quarters of all changes occur at a 
time when a simple change to the product data is no longer sufficient. If changes in the 
planning and development phase can often be implemented by short iterations and 
adaptation of the product data, the lack of manufacturability and assemblability in 
the production phase, in particular, cause a large part of the change expenditure [84, 
116]. 

Therefore, one of the most important tasks of change management is to avoid late 
changes and to shift changes into early phases by determining and recording product 
requirement as completely as possible [18, 62, 190]. In addition to DIN 199-4 [67], 
other change management approaches such as the “Generic Engineering Change Pro- 
cess” according to Jarratt [162], the “Strategic Automotive Product Data Standards 
Industry Group” (SASIG) [233], the “Implementation of a milestone-supported Cus- 
tomer Change Management” according to Sauer [234], the “Decentralised Change 
Management” according to Kleedoerfer [170], the “Design Change” process accord- 
ing to Yu [284], the “advanced CMII-based ECM framework” according to Wu [282], 
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“engineering change process framework” according to Stekolschik [255] and the 
“Generic Engineering Change Process” according to Riviere [229] exist. 

A large number of scientific approaches include a structured representation of the 
change process, which implies the need for clear, formalised process steps. Currently, 
none of the scientific publications fully meets the requirements described for the 
integration of a cause and effect analysis in the early phases of process flow. 

Strategies for the avoidance and control of technical changes are frequent 
approaches of the scientific literature to make change processes more efficient, to 
increase quality and to reduce costs. However, the applicability of the strategies to 
change processes in individual production must be examined. 

Many of the models presented were derived from series production processes. 
Since none of the work adapts the models to individual production, it can be assumed 
that direct transferability is not possible. Furthermore, the deficit of missing integra- 
tion of customers into the change process becomes apparent. The method’s orienta- 
tion towards customer-related changes is only postulated in the work of Sauer, which 
focuses on customer changes during the change process execution. In the following, 
the structure of the adapted change process (see Fig. 5.15) is described. 

The model aims to support companies in the implementation and execution of 
customer-integrated change management. In addition, the procedure model serves 
as a planning instrument to make the phase-specific activities transparently available 
to the involved stakeholders. The relevance of the customer is taken into account to 
the extent that the customer is the core element at the centre of the model. The change 
procedure itself is represented in nine steps. In addition to the customer and the phases 
of the change procedure, the outer layer, consisting of the three areas “Management 
& Organisation”, “Human Resources” and “Methods & Aids”, completes the basic 
structure. 

In the following, the individual phases of the change procedure are described. The 
first phase of the procedure is defined as the phase of deviation analysis. This phase 
includes an examination of the target and actual values and can therefore be seen 
as a trigger for a change process. It is of high relevance that the underlying causes 
are identified in the case of a detected deviation. The deviations are the basis for a 
change request. In addition to a deviation analysis, further preliminary calculations 
are necessary. In the following phase of the procedure “write request’, the information 
for the rate request is summarised. The preceding phase of write request, rate request 
and application decision excludes changes at an early stage which do not promise 
success. If the change request is approved, from a macroscopic point of view, the 
planning phase begins, which consists of the phases, finding solutions and detailing. 

In the phase of finding solutions, classical methods support the operator in the 
generation of possible solutions as well as in the subsequent phase of solution evalu- 
ation, which includes a risk and impact analysis. The involvement of the customer is 
an important component to benefit from his extended application experience. In addi- 
tion, active involvement takes place in the change decision phase in order to record all 
customer requirements. For this purpose, communication channels, such as meetings 
or e-mail exchanges, or software-assisted tools can be used. In a transparent and com- 
prehensible decision-making process misunderstandings due to the “communication 
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Fig. 5.15 Overview of the procedure model 


barrier” between companies and customers but also between departments can be 
eliminated. Once a satisfactory solution has been found, evaluated and approved by 
the change control board taking into account all economic and technological criteria, 
the change implementation phase begins. 

Depending on the scope of the change and the point in time when the need for 
change is discovered, the implementation phase is in the simplest case a simple 
document change; however, for complex processes the change process can extend 
over different departments and over a longer period of time. As in general project 
management, it is important that the change status, cost and schedule are continuously 
monitored. In addition to the technological implementation, the change procedure 
is concluded with a conscientious and detailed change review. In addition to the 
documentation of all changed data, this also includes a preparation of the data in 
the sense of a “change review” for individual production (Fig. 5.15). The individual 
phases differ in the scope and depth of the description. This is accompanied by the fact 
that methodological aspects are of particular importance in the analysis, evaluation 
and decision phases as well as in the change review phase. Special expertise and 
procedures predominate in the phases close to implementation. This expertise is not 
generally valid and can therefore only be described insufficiently [156]. 
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Procedure model on the example of the 3D servo press 


The presented modification procedure is applied to the case of sensor integration for 
the control optimisation of the 3D Servo Press, Sect. 3.6.3. The change was initiated 
by the requirement to integrate an additional monitoring and closed-loop control of 
the process force by means of integrated force sensors. This change was motivated 
by a technical innovation, with the aim of implementing the changed requirements 
with regard to the closed-loop control of the machine. Accordingly, an adjustment 
of the target property is carried out.The idea for the modification came from the 
Research and Development Department (R&D) at a time when large parts of the gear 
unit (Sect. 3.6.3) had already been manufactured but not yet assembled. Similarly, 
production of the lower part has not yet begun. Since the internal customer, in this 
case the R&D department, has initiated the change, the customer is fully involved 
in all processes of the change process. The change request is justified by the fact, 
which Groche et al. [126] have determined, that a closed-loop control of presses 
via the engine parameters and kinematics model is not sufficient due to friction. A 
first solution suggested by the customer is the integration of the sensors in the direct 
force flow, which is carried out for each individual gear. Thus, the integration of 
the sensor technology focuses on the components located in the direct force flow 
between bearing frame and gearbox. The drive rod, which is located in the direct 
force flow between the bearing frame and the gearbox, turns out to be the most 
promising component to be changed. The cost of the change can be identified as the 
procurement of the sensors and the integration into the production process. It should 
be noted, however, that the drive rod was already finished but not yet assembled. 
Furthermore, the need for action, effort and costs for the modification were estimated. 
To find a solution, a conventional procedure is used whereby creative methods such 
as brainstorming were used to develop the design solutions shown in Fig. 5.16. 

The technical feasibility, costs and effort of the respective solutions were evalu- 
ated by the core team and in coordination with sensor vendors and manufacturers. 
The uncertainty of the respective solution regarding robustness in operation, sensor 
failure, overload and reduction of gear stiffness was to be evaluated. At the same 
time, production costs and effort must be included in the analysis. The first solution 
with direct force measurement using a piezoelectric-force measuring ring between 
the drive rod and the bearing frame proved to be the simplest solution in terms of 
feasibility and costs. However, this solution has the greatest influence on the strength 
of the gear. The second variant can be described by indirect force measurement using 
a force measuring ring in the force shunt. A part of the force is transmitted directly 
via the structure into the bearing frame, another part is transmitted via an adapter 
plate and the force washer in order to measure the process force. The advantages are 
higher rigidity and low stress on the sensor. Production, on the other hand, is more 
complex, because it is necessary to achieve a uniform height of the bearing surface 
and the drive rod on the bearing frame. The third variant involves the integration 
of a surface strain sensor, which also operates according to the piezoelectric effect. 
This approach is already used in the prototype of the 3D Servo Press and proved 
successful. However, three sensors each are required on the drive rod in order to 
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Fig. 5.16 Example of a change to the drive rod of the 3D Servo Press 


obtain high-quality force measurements in the event of a possible deflection of the 
drive rod. A calibration of the installed sensors is necessary for all three variants and 
does not represent an advantage or disadvantage for any variant. 

All three variants are subsequently evaluated by the internal customer and the 
project core team. In the questioning of the customer after the fulfilment degree of 
the respective variant, based on the classification of the change request the third 
change variant is evaluated most positively. The decision is then documented and 
made available transparently to all parties involved. The change variant is released 
and orders are issued to carry out all necessary change tasks. The responsible change 
manager is commissioned to take over change controlling and to regularly inform the 
customer and the Change Control Board about the status of implementation. The last 
step ofthe change review completes the change procedure. Further change processes 
follow the same procedure, as shown in the example of the 3D Servo Press. 

The procedure model presented shows that the formulation of the question has 
a considerable influence on the classification of the customer needs. With regard 
to the requirements, there is a clear difference in the product to be developed. The 
transferability to serial production is possible, however, associated with clearly larger 
expenditure in the organisation. 
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5.3 Mastering Propagated Uncertainty in Process Chains 
Peter Groche and Florian Hoppe 


The production phase in the life cycle of products or systems, linking the design 
phase with the usage phase, see Sect. 1.2, is usually structured as a process chain. This 
section describes methods to master uncertainty along process chains. Following the 
representation shown in Fig. 3.3 in Sect. 3.2, a process chain consists of subsequent 
single processes, each of which is subject to disturbances. Furthermore, the material 
fed into the process to produce the product contributes to uncertainty, e.g. by semi- 
finished product variations. 

Uncertainty during the production process propagates into the product and can 
make it infeasible to carry out subsequent steps in a production chain or to guarantee 
product quality. To manage this challenge, standardisation methods have been used 
for several hundred years. If the effect of uncertainty is particularly known, i.e. incer- 
titude, it can be mastered by the definition of tolerances, cf. Chap. 2. However, since 
the influence of the uncertainty along the process chain is often unknown, it is possi- 
ble that relevant product properties being subject to uncertainty and being important 
for quality are not considered; or the definition of tolerances for the considered prop- 
erties is not appropriate. To cope with uncertainty in process chains, two processes 
have emerged in the last decades: firstly, robust single processes make the process 
chain less sensitive to quantified uncertainty, as they fulfil their function, even if the 
system is disturbed in a limited and predictable way, cf. Sect. 3.5; secondly, modern 
resilient processes, as introduced in Sect.3.5, do not only allow to react to distur- 
bances but also to learn from them in order to master unknown effects of uncertainty, 
i.e. ignorance (see Chap. 2). In the following subsections, examples are given on how 
to react to disturbances in order to ensure function and quality (see Chap. 1) of the 
system, which is in this case represented by the process chain itself. Furthermore, 
we illustrate how product property defects can be fed back in such a way that the 
process chain acquires the resilience functions of learning and anticipating, which 
are described in detail in Sect. 6.3. Using the example of a combined process chain 
which consists of forming and cutting processes, it is shown how uncertainty can be 
reduced (Sect. 5.3.1). In Sect. 5.3.2, the regulation of product specific requirements 
and the effects on the uncertainty are discussed. With this knowledge, it is shown 
how the propagation of uncertainty can be quantified and how the process chain can 
be adapted at an early stage of the production process. Section5.3.3 provides an 
example for a flexible process chain using the 3D Servo Press in order to adapt prod- 
uct properties during the production process. One approach to master uncertainty by 
reducing process-related fluctuations in product quality are smart structures. Inte- 
grated in load-bearing structures and machine elements, as shown in Sect. 5.3.4, they 
can be used to monitor and control the production process (Sect. 5.3.5). Section 5.3.6 
shows a new process-integrated calibration method to increase efficiency in the man- 
ufacture of smart structures. 
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5.3.1 Uncertainty Propagation in a Forming and Machining 
Process Chain 


Felix Geßner, Maximilian Knoll, Christian Bölling, Florian Hoppe, Eberhard Abele, 
Matthias Weigold, and Peter Groche 


In production, the interlinking of forming and machining processes represents a 
classic value chain. Process chains, as described in Sect.3.2, are characterised by 
uncertainty, such as batch-related uncertainty in the material properties or positioning 
uncertainty of the machine tool. Furthermore, the open-loop or closed-loop control 
of the machine tool affects uncertainty (Sect. 5.3.2). 

In the context of process chains the concept of the Austauschbau, as described in 
Chap. 2, plays a decisive role. One way to master uncertainty in form of incertitude 
in the Austauschbau is by defining tolerance limits, within which the component has 
to be positioned during the transition between the process steps. The definition of 
tolerance limits is usually done opposite to the direction of the value chain starting 
with the finished part. The required tolerances of the preceding process steps are 
usually determined according to the experience of the employees. As a result, the 
accuracy requirements of early process steps are often based on a subjective view. 
In particular tolerances that are too tightly selected allow little room to compensate 
fluctuations in raw material quality, for example, although the continuous optimisa- 
tion of production steps enables the development of controlled processes or robust 
tools that are able to master larger uncertainty in component specifications. 

Since process simulation and optimisation are often focused on one single pro- 
cess, predictions of component quality over the entire process chain are currently 
difficult to assess and heavily depend on experience and knowledge [46]. However, 
little attention is paid to the interfaces between the processes that are critical for link- 
ing the different process steps. One reason for this lack is that there are hardly any 
compatible interfaces between different simulation tools [46]. With the current pro- 
duction approaches, variable products with application-specific requirements, such 
as required by the MAFDS (Sect. 3.6.1), cannot be realised taking uncertainty into 
account. Therefore, we investigate a possible combined process chain consisting of 
cutting, forming, heat treatment and machining (see Fig. 5.17), with the main focus on 
the forming and cutting processes. We chose orbital forming, an incremental forming 
process, in which only a partial contact surface is created between the punch and the 
workpiece, as an exemplary forming process. Relative to a point on the workpiece- 
tool contact surface, the stress builds up accumulatively due to the intermittent tool 
contact. At the same time, the lower rolling friction between the workpiece and the 
punch enables a radial material flow, also known as the mushroom effect [187]. 
This effect can be controlled by varying the tool angle, the feed rate and the rota- 
tional speed in order to counteract fluctuations in the semi-finished product [58]. The 
forming machine we use is a 3D Servo Press (as described in Sect. 3.6.3) with three 
independently controllable degrees of freedom in the slide [126]. Since we control 
the material flow by adjusting the process parameters due to previous semi-finished 
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product uncertainties, it is necessary to predict the effects on the subsequent steps, 
such as reaming. By coupling the forming prediction with the reaming prediction, a 
closed-loop process control can be achieved, which reduces the uncertainty due to 
semi-finished product variations. 

As a first step we implement the forming process in a 3D finite element simulation 
using the simulation tool Simufact Forming to map the relevant forming step [46]. 
In the simulation a tube with an nominal outside diameter of 48 mm and a nominal 
initial height of 34mm is formed to a bevel gear with a nominal height of 17.7 mm. 
During the forming process a perforation with a nominal diameter of 7.5mm is 
added to the centre of the bevel gear. The influence of the parameters tool angle, 
infeed speed and form of motion on the resulting material flow is investigated and 
variables for process control are identified [58]. At the same time, variations in the 
angle at a constant tool angle lead to a deviation of the height profile. This requires 
compensation by calibrating the workpiece towards the end of the orbital forming 
process by levelling the surface with a constant angle. 

While we use the material flow as a variable in further work to control the compo- 
nent geometry with regard to mould filling and height, quantitative evaluation of the 
effect on perforation requires coupling to a reaming simulation. Furthermore, this 
enables the optimisation of the reaming strategy based on formed components. 

Reaming is often used towards the end of the value chain. It serves the purpose of 
producing functional bores with shapes and of positioning within a required tolerance 
range. For productivity reasons, multi-bladed reaming tools that combine the func- 
tions “cutting” and “guiding” in one tool element are often used. These tools have 
been the subject of scientific investigations. The influence of disturbance variables 
on the quality of the reamed bore is investigated with regard to diameter, circularity 
and cylindrical shape on the one hand [38, 179] and the deflection of the tool on 
the other [45, 145]. Tool deflection leads to an increased diameter of the envelope 
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cylinder of all bore centres of the reamed bore. Adapting the cutting edge geometry 
by increasing the setting angle results in a reduction of tool deflection in the transient 
entry phase into the workpiece. An upstream pilot process achieves a significant 
reduction of the deflection, especially with long cantilevered tools with a length-to- 
diameter ratio of L/D ~ 10. The model we used to simulate the reaming process is 
the mechanistic model described in Sect. 4.1.3. Itis based on a geometric intersection 
model to calculate the undeformed chip cross-section [1], an empirical cutting force 
model [3] and a multi-body model to represent the dynamic tool behaviour based on 
the Jefcott rotor theory [44]. 

A central point for the representation of the process chain is the linking of the 
individual models of the forming and machining processes. Figure 5.18 illustrates 
the interface to transfer the geometry between simulations. One output variable of 
the forming simulation is the surface of the part after forming. The component sur- 
face is represented in standard tessellation language file format (STL) by numerous 
triangular faces and their respective three vertex points. We then generated a new 
cylindrical grid using the vertices to remesh the wall of the punch hole in steps of 
1°. The polygons of the 2D element model, which represent the workpiece in the 
reaming simulation, are then generated from the nodes of the newly meshed grid. 

The perforation in the centre of the component, which is produced during the 
forming process, is machined using reamers in order to generate a high quality cylin- 
drical surface. To investigate the influence of the process and geometry parameters 
on the displacement of the reaming tool, a tool with a diameter of D = 8.3 mm and 
a cantilever length of L = 30 mm is simulated. We vary the process parameters with 
regard to achieving a constant feed rate of f = 0.6 mm/rev during the entire machining 
process. In addition, we determine a suitable running-in strategy, using a reduced 
feed rate of 0.1 ™™/rev until a reaming depth of 4mm, followed by an abrupt increase 
to achieve the final feed rate. In the case of machining valve guides in the cylinder 
head of a combustion engine, we demonstrate the positive influence of an upstream 
pilot process using a short cantilevered reaming tool [45]. The diameter and can- 
tilever length of the pilot reamer are reduced by 0.1mm and 10mm respectively. 
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The depth of the pilot bore is 2 mm. For all simulations we chose a cutting speed of 
100 m/ min. 

Typically, reaming tools with a setting angle of x = 45° are used in industrial 
practice for standard applications. In theory, increasing the setting angle to k = 
75° leads to a reduction in the passive force F, at the individual cutting edges, 
reducing tool deflection especially in the face of disturbance variables. In the case of 
upsetting, using a reaming tool with a setting angle of k = 75° can reduce the tool 
deflection by 25% compared to a tool with a setting angle of x = 45°. Considering 
orbital forming, the use of a reaming tool with a setting angle of « = 75° can reduce 
the tool deflection by 45%. In both cases, however, the tool deflection, even with 
adapted cutting geometry, is still about 20 um, based on a machining depth of 17 mm 
(Fig. 5.19a). For functional bores, which serve to guide other components, it is often 
necessary to minimise the tool deflection and the associated reduction of the radial 
deviation of the reamed bore even further in order to fulfil the functions and reduce 
the wear symptoms. 

Therefore, in a second step, we investigate various machining strategies for the 
reaming process of the formed components (Fig.5.19b). Based on the previous 
results, we select k = 75° as the setting angle of the tool. The results of the simu- 
lation indicate the positive effect of an adapted running-in strategy (Fig.5.19b). By 
reducing the feed rate during the entry phase into the workpiece, we could reduce the 
process forces significantly and thus minimise tool deflection. In the case of upset- 
ting, we can reduce the tool deflection by 65% from 20 um to 71m. With orbital 
forming, a 45% reduction in deflection from 21 um to 11.5 um can be achieved. Thus 
an improvement of the reaming quality can be obtained without the employment of 
further tools and with an increase of the main time from 0.5s to 1s. The introduction 
of a pilot process upstream of the actual reaming process enables a further signifi- 
cant reduction in tool deflection. Due to the increased stiffness of the pilot reamer, 
it is hardly deflected despite the occurrence of disturbance variables. In theory the 
following reaming process has a reduced radial allowance of a, = 0.05 mm up to a 
depth of 2mm due to the preceding process in the transient entry phase. In addition, 
the influence of disturbance variables within these 2mm can be largely eliminated 
by the pilot process. Therefore, the deflection of the tool can be limited to values 
around I um. 

The presented results illustrate the possibilities of a coherent consideration of 
forming and machining process step within the process chain. By using the simula- 
tion tools, we could show that different process parameters during the forming of the 
workpiece have a significant influence on the component geometry. An unfavourable 
selection of forming parameters leads to imperfections in the perforation after form- 
ing. Without an adapted reaming process this would cause an interrupted cut during 
the reaming operation and impaired bore quality. By using the knowledge from the 
combined models along the process chain, however, the uncertainty in the reaming 
process can be mastered. With the selection of a suitable cutting geometry and an 
adapted machining strategy, a significant reduction in tool deflection is possible. Fur- 
thermore, the results from the analysis of the process chain can be fed back into the 
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Fig. 5.19 Deflection of the reaming tool as a function of a the setting angle and b the machining 
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forming process in order to establish a closed loop for the control of uncertainty in 
the process chain and thus master the chained uncertainty. 


5.3.2 Closed-Loop Control of Product Stiffness and Geometry 
Florian Hoppe, Peter Groche, and Maximilian Knoll 


Uncertainty in manufacturing processes affects the properties of a product and as a 
consequence affects the product’s usage behaviour. Currently, product properties are 
ensured in an open-loop approach by skilled workers and process planners. Product 
quality therefore depends mainly on the experience and qualification of these people. 
At the same time, changing and increasingly complex process chains present a grow- 
ing challenge. Changes in the process chain and uncertainty in ambient conditions as 
well as properties of the raw materials affect both, product and process. Therefore, 
methods are needed to master uncertainty in the production phase (Sect. 1.2) and 
along the complete process chain. 

The automatic closed-loop control of forming processes experiences a constantly 
growing attention, focussing on the control of individual geometric product proper- 
ties [8]. The automation of production processes, however, is accompanied by the fact 
that several product properties need to be controlled simultaneously and boundary 
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Fig. 5.20 Levels of automation in manufacturing processes [125] following the VDA [268] 


conditions have to be met. Sometimes, the properties to be controlled are conflicting 
with each other. The requirements for automated driving proposed by the German 
Association of the Automotive Industry (German abbreviation: VDA) can serve as 
an analogy where a fully automated car is in charge of all the driving and does not 
require any human intervention [268]. When transferred to manufacturing, a fully 
automated process requires that all relevant product properties are controlled and 
that boundary conditions are not only met but also extended if necessary [125]. 

To differentiate the degree of automation of process chains, the VDA introduced 
different levels as shown in Fig.5.20, which are determined by the autonomous 
abilities of the system, in the style of the levelling scheme used for autonomous 
driving cars. 

The objective in increasing the automation level is the reduction and compensation 
of disturbances, i.e. to increase the robustness of the process, compare Chaps. 3 
and 6. By breaking this objective down into sub-objectives, subtasks can be defined 
and automated piece by piece. For example, tasks that are carried out by the staff at 
lower levels can be replaced by automated quality inspection systems and closed-loop 
control at higher levels. 

Both, control methods and equipment for measuring and manipulating product 
properties, are required to climb the automation levels. But we already face a conflict 
of objectives when measuring product properties, which is between good measura- 
bility and information content (Sect. 5.2.4). With increasing spatial distance between 
the machine drives and the product being manufactured, the manipulability of the 
product properties decreases. Furthermore, the uncertainty increases with increasing 
measuring distance to the product [56]. Moreover, the use of adjustment mechanisms 
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leads to a high effort in process design if tools have to be equipped with additional 
actuators. Solutions to this problem are offered by presses with several degrees of 
freedom in the ram, such as the 3D Servo Press presented in Sect. 3.6.3. By hav- 
ing the complexity of the actuators in the machine, new processes can easily be 
developed [58, 160], and passive standard processes, such as deep drawing, can be 
enhanced [51]. 

Under the assumption that the product properties, i.e. the controlled variables, can 
be determined, their optimal manipulation represents a new challenge. The manipu- 
lating variables are drive motions but also, among other properties, the tool design, 
lubrication, temperature. These influence the product properties in a non-linear way. 
Finding optimal process variables is an iterative process and supported by simula- 
tions. Once the desired product properties are achieved, the manipulating variables 
are kept constant and process fluctuations are kept to a minimum using open-loop 
control. However, if disturbances occur, such as deviating material properties in a new 
batch or fluctuating semi-finished product properties, an open-loop control cannot 
compensate for this [57]. 

On the other hand, closed-loop control of individual product properties allows to 
adjust the process to deviant product properties by feeding back the actual product 
property. Incremental forming processes are particularly suitable, since they can 
be controlled from one increment to the next. In free bending, for example, the 
springback of the material is a decisive influence of the final component geometry. 
The latter depends strongly on the material properties of the current workpiece. By 
measuring the geometry after springback while still clamped, the bending operation 
can be adjusted and iterated to the desired geometry, as we demonstrated in [58]. 

Although the product’s geometry is its most evident property, it is only one of 
many relevant properties. This is demonstrated in the Modular Active Spring-Damper 
System (German acronym: MAFDS), see Sect. 3.6.1, which contains, among other 
components, active support with spring membranes. In addition to the geometry, 
these must rely, above all, on the stiffness of the spring membranes. While the geom- 
etry ensures the mountability, the stiffness is decisive for the function of the shunt- 
damping, as well as the active buckling stabilisation. The stiffness of the membranes 
is mainly determined by the material properties and their geometry. Single-Point- 
Incremental-Forming (SPIF), a process in which a sheet metal component is incre- 
mentally formed with a tool tip, is therefore particularly suitable for production. 
The process makes it possible to produce almost any geometry, as long as the load- 
bearing capacity of the material is maintained. If variations in the material occur, the 
stiffness can be corrected by making minimal adjustments to the geometry within 
the tolerable limits [155]. 

Whereas open-loop control acts, closed-loop control reacts, i.e. it only takes action 
when a deviation is detected. This is acceptable for disturbances with slow dynam- 
ics. However, if the disturbances occur with high dynamics from part to part, as 
is usual in production, the controller is unable to handle them well. Examples for 
such disturbances are fluctuations in the lubrication and the semi-finished product 
properties. Nevertheless, sometimes information about the material properties of the 
semi-finished product can be aggregated from process data of upstream processes. 
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Fig. 5.21 Resilient process chain by means of closed-loop process control with disturbance feed- 
forward [124] 


With the aid of disturbance models G,(z) we anticipate the effect of measurable 
disturbances v on the final product properties and compensate it using a disturbance 
feedforward control [124]. For example, shear-cutting processes are typically carried 
out prior to the actual forming operation. Disturbances are already visible in the force 
measurements of the cutting data. However, it remains challenging to select data fea- 
tures containing enough information to predict the product properties. Methods from 
the field of machine learning offer the possibility to identify relevant features from 
a data set and to create prediction models [159]. 

The effect of such measurable disturbances v can then be compensated for before 
they become noticeable in the product. However, we typically face disturbances ¢ 
that cannot be measured, or whose effects on the product properties are not known. 
Based on a known process transfer function G,(z), we combine the disturbance feed- 
forward G7! G, (z) with a closed-loop control G, (z) to a resilient process chain shown 
in Fig. 5.21. Such a control structure compensates for abrupt fluctuations caused by 
batch changes, as well as long-term disturbances, such as wear and temperature drifts. 
While the tool can also be equipped with additional temperature sensors, measuring 
the wear online is still a research issue. 

The coupling of different product properties challenges their simultaneous control. 
When correcting one product property, additional control measures are necessary to 
keep the other product properties constant. Boundary conditions further intensify this 
problem. To decouple product properties when implementing a closed-loop control, 
models are required that describe the effect of the manipulated variables and the 
coupling of the product properties. Since these models usually can only be evaluated 
by simulations, extended control approaches are necessary. The model-predictive 
control is a suitable approach, which is based on the recurrent solution of an optimal 
control problem. By means of an optimisation algorithm new optimal control vari- 
ables are obtained after each forming step. Uncertainty, which becomes visible in 
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the deviation of the predicted and measured product property, is taken into account 
after each step. This results in a closed control loop [160]. 

Future highly automated manufacturing process chains require cross-process con- 
trol loops that predict and compensate for deviations. Current developments show that 
an online closed-loop still presents major challenges. Its realisation requires both, 
observers that estimate the final product properties during the process, and con- 
trol devices that enable real-time control actions. We presented methods to control 
product properties beyond its geometry while complying with predefined boundary 
conditions. This requires the real-time manipulation of actuators involved in the pro- 
cess. Especially the real-time interface to a forming machine is crucial for future 
process control. While the research press presented in Sect. 3.6.3 already allows for 
online control, industrial forming machines do not offer such interfaces, yet. 


5.3.3 Controlled Partial Post-compaction of Sintered Bevel 
Gears 


Peter Groche, Julian Sinz, and Daniel Martin 


Powder metallurgy serves as a manufacturing technology for a wide range of appli- 
cations, one example of which is the manufacture of gear wheels. Powder metal- 
lurgical production offers economical and ecological advantages, such as profitable 
cycle times, good automation possibilities [238] and an optimal use of raw materials, 
due to the possibility of producing near-net-shape components [78]. Furthermore, 
the sintering of components from powder materials offers the possibility to realise 
different material combinations which cannot be produced by melting metallurgy at 
all, or only with increased effort [238]. However, the use of gears for power trans- 
mission in safety-relevant systems places high demands on process reliability and 
the final component quality [83]. 

Sintered components are porous bodies whose mechanical properties depend on 
porosity and pore density [238]. The porosity P describes the volume fraction of 
pores present in the component, while the pore density is the ratio of the number of 
pores to the length of the body. Pores lead to material weakening due to notch effects 
under load and are therefore a possible source of component failure, especially in 
areas of stress concentrations [55, 137]. A local reduction of the porosity can increase 
the fatigue strength of sintered components [209, 259]. For this reason, a targeted 
post-compaction of the most heavily loaded component areas is used to minimise the 
local pore content. In this way the quality of the product can be improved in terms 
of an increased availability, cf. Sect. 1.7. 

Since both process stages, i.e. sintering and post-compaction, place different 
demands on the functionality of the machines used, conventional post-compaction 
takes place in a separate process step downstream of the actual sintering process. This 
means that the process is associated with additional costs for machines and tools, 
as well as a higher logistical effort [23, 197]. In order to better exploit the potential 
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of powder metallurgical production for safety-relevant components of load-bearing 
structures, we developed a process concept that enables the combination of both pro- 
cess steps, the sintering process and the post-compaction, in one process sequence. 
For this purpose, the additional degrees of freedom in the ram motion of the 3D Servo 
Press presented in Sect. 3.6.3 are used to realise an integrated partial post-compaction 
process at the example of bevel gear manufacturing. 

A measure for the quality of the post-compaction process is the relative density D, 


defined as 


pore volume 
D=1-P=]1 


; (5.14) 
total volume of the porous body 


In the following we present a simulation model which serves to predict the relative 
density distribution in sintered components. This model is validated by experiments 
for an uniaxial load case and then extended for three-dimensional load conditions. 
The resulting model will be used to develop a process strategy for the partial post- 
compaction of sintered bevel gears using the 3D Servo Press. 


Development of a simulation model for the uniaxial load case 


A continuum-mechanical simulation model was developed. The governing equations 
were solved by a Finite Element (FE) solver, which was extended by an adequate 
material model for the process design. This model was adapted to the requirements 
of the specific application and validated by means of real tests to ensure that the 
model predicts the process behaviour in the best possible way and thus minimises 
model uncertainty as described in Sect. 2.2. 

According to Parteder [220], the relative density D is used to assess the residual 
porosity at the end of the manufacturing process. The used material model must there- 
fore primarily ensure the mapping of density development during the process. The 
Gurson model [136], based on the material behaviour according to Levy-Mises and 
described by a yield criterion, is able to predict the behaviour of porous media [220]. 

The development of the relative density can be calculated from the flow potential ® 
as described by Parteder [220]. In order to take individual material properties into 
account, this model has been extended by further model parameters q; (i = 1, 2, 3) 
according to Tvergaard [264], which includes the dependence of the yield stress on 
the density [98]. 

The change in pore shape during the process has a significant influence on the 
density development [54, 182, 220]. Therefore, instead of constant Tvergaard param- 
eters, condition-dependent parameters are used, which are adapted to the temporal 
deviatoric deformation £e during the simulation on the basis of experimentally deter- 
mined material parameters. The necessary material data were generated in uniaxial 
compression tests with cylindrical specimens made of porous pure iron. 

Results from the real uniaxial tests are compared with the simulation results. The 
evaluation of the model uncertainty is based on the components’ densities in different 
stages of the compression tests. Experimental data of the porosity are derived from 
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Fig. 5.22 Comparison between a constant Tvergaard parameters and b state dependent parameters 
after 4 consecutive post-compaction stages for an initial absolute density p = 6.4 g/cm? according 
to Brenner [50]; the current absolute densities after each stage are 6.6 g/cm? (stage 1), 6.8 g/cm? 
(stage 2), 7.0 g/cm? (stage 3) and 7.2 g/cm? (stage 4); the values in the tables show the percentage 
deviation between experiment (E) and simulations with defined process forces (F) and defined punch 
displacements (P) 


optically recorded microsection samples of the test components. A comparison of 
results from simulation and experiment is shown in Fig. 5.22. The data correspond 
to the relative density D after one to four post-compaction stages. The different 
stages represent specific values of the absolute density p reached in the experiment 
after a defined punch travel or process force. The density in the initial state is set 
to 6.4 g/cm?. The input parameters for the simulation are either defined process 
forces (F) or punch displacements (P). Values of both types of parameters correspond 
to the measured ones in test stages with defined values of density. The black bars in 
the middle represent the experimentally determined values (E). 

The displayed results exhibit an overall good agreement between the simulation 
with state-dependent model parameters (Fig. 5.22b) and the experimental results for 
this uniaxial load case. The deviations between simulation and experiment are small. 
This is especially true for the simulation with predefined punch displacements. In 
comparison, a larger deviation can be determined using constant Tvergaard parame- 
ters as displayed in Fig.5.22a. This shows that the model uncertainty can be signifi- 
cantly reduced by using state-dependent model parameters. 


Adaptation of the model for multiaxial loading 


The prevailing stress conditions in forming processes are usually multiaxial. The 
compaction of an isotropic material is based on the mechanism of pore closure within 
the material, which is decisively influenced by the prevailing stress state [220]. For 
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Fig. 5.23 Comparison of the spatial distribution of relative density D between a experiment and 
b FE simulation for a ball indentation test (rs = 10 mm) according to Strauß [256] 


this reason, a suitable comparison variable is required to investigate the density 
development as a function of different stress states. Therefore, a modification of the 
Gurson-Tvergaard model including the multiaxiality X in the determination of the 
Tvergaard parameters g; was performed. The multiaxiality X is defined as the ratio 
of the hydrostatic stress component op to the deviatoric stress ce [220]. These can 
be calculated from the stress components o; in the three principal directions: 


3 
x_%_”% od (5.15) 


ce 3 Slo - m+ - ar + (3-01) 


In order to improve the prediction accuracy of the simulation model for the multiaxial 
load case, the parameters g; (&., X) depending on the deviatoric deformation ¢, and 
the multiaxiality X can be determined with the help of a cell model calculation 
according to Needleman [205] and Tvergaard [264]. The cell model calculation 
establishes a relationship between the microscopic properties of the material and its 
macroscopic damage behaviour [220]. 

After the successful implementation of the cell model calculation into the FE 
simulation using subroutines to determine the state-dependent model parameters, 
we performed a validation of the advanced model using ball indentation tests. A 
hardened (55-65 HRC) spherical tool component, which is assumed as rigid in the 
simulation model, with a ball radius r, is pressed into a sample body with a press 
force increasing linearly over the penetration depth up to a maximum of 70KN. The 
investigations were performed with sphere radii of 5 and 10mm. The load cases of 
the simulation are given by the course of the press force. 

The spatial distribution of the relative density at the end of the indentation process 
serves as a comparative quantity. The penetration depth achieved is 4.75mm. In 
Fig. 5.23 the optically evaluated relative density distribution of the experiment (left) 
for r, = 10 mm is compared to the simulation result. The comparison shows a good 
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Fig. 5.24 Schematic 
illustration of a a 
conventional purely vertical 
ram movement compared to 
b the ram movement in a 
tumbling compaction 
process as possible on the 3D 
Servo Press according to 
StrauB [256]: the arrows 
symbolise the degrees of 

freedom (a) (b) 


qualitative agreement, especially in the contact area, where fully compacted material 
is present. The largest deviations occur in the upper edge area, since the ejection 
process necessary in the experiment leads to an increase in density of the surface area 
due to the ejection force. In addition, the course of the density in the centre deviates 
noticeably in the axial direction. This is probably due to uncertain test conditions 
that cannot be taken into account in the simulation, such as the existence of backlash 
between the test specimen and the die, which leads to radial displacements of the 
test specimen. As a result of the validation, however, a sufficient accuracy of the 
simulation model for the application in multiaxial load cases can be determined. 


Process strategy for partial post-compaction 


In addition to the vertical degree of freedom in conventional presses, the 3D Servo 
Press described in Sect. 3.6.3 has the additional option of tilting the ram. This allows 
the press ram to be deflected by an angle of up to approximately 3°. In this way, the 
vertical ram movement can be superimposed by, for example, tumbling or swivelling 
movements in two planes [128]. Based on the developed simulation model, an FE- 
supported design of optimised post-compaction processes was carried out. The aim 
is to investigate the potential of process integration of post-compaction processes 
for the property adjustment of porous sintered components. The multiaxis post- 
compaction process takes place by utilising the additional ram degrees of freedom of 
the 3D Servo Press in the form of a tumbling tool movement. Figure 5.24 schemat- 
ically sketches the process concept for the tumbling post-compaction compared to 
a conventional unidirectional compaction. The three independently controllable and 
adjustable eccentric drives enable the realisation of a tumbling die movement by 
phase shifted translational movements of the three ram drives, see Sect.3.6.3. 

In this way, the degree of compaction can be specifically influenced in the post- 
compaction process. The aim is to partially increase the relative density D of the 
end product in the critical stress zones in order to avoid component failure caused by 
residual porosity. In the case of gear manufacturing, these are located in the marginal 
zones, such as the tooth flanks and the tooth root [137]. The edge zones of the tooth 
tip are also the goal of further optimisation with regard to the possible degree of 
compaction. 
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Fig. 5.25 Simulation results for the density distribution a after the conventional uniaxial process 
compared to b the optimised compaction process according to Strauß [256] 


To estimate the achievable local degree of compaction by means of a specific ram 
inclination, the post-compaction of a single tooth is simulated. The modified tool 
paths alter the material flow, the influence of which on the result of the compaction 
process is investigated. The sample to be compacted consists of a simplified tooth 
geometry, which is derived from an involute gearing. Exploiting the symmetry only 
half of the geometry is modelled. 

In Fig. 5.25, the spatial distribution of the relative density after the post-compaction 
process is compared to the density distribution of the uniaxially compacted tooth. 
Here, the density values in the area of the tooth flank and the tooth root are signifi- 
cantly lower than in the tumbling process. It is only in the area of the tooth tip where 
a fully compacted material area is visible. The density distribution in the remaining 
areas, however, is more homogeneous than in the tumbling process. 

On the basis of the simulations carried out, a clear influence of the friction in 
the contact area between workpiece and die can be observed. Furthermore, large 
deformations are visible at the edge areas close to the contact zone between workpiece 
and die. It can be expected that the higher density in highly loaded product areas will 
lead to an improvement of the product’s durability and strength. 

The results show that extended tool kinematics can be used to positively influence 
compaction processes. Especially if locally high densities are required, tumbling 
motions can have a positive influence on the density development in critical compo- 
nent areas. 

With the presented application, we have optimised the manufacturing process 
of a machine element in such a way that the properties of the end product can be 
specifically influenced without a subsequent separate processing step. The use of 
the 3D Servo Press enables a flexibilisation of the process chain. Thus, a consistent 
product quality can be achieved by adapting the manufacturing process to product 
requirements that arise in the usage phase and are not yet known during the design 
phase. 
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5.3.4 Forming Integration of Functional Materials 
in Load-Bearing Structures and Machine Elements 


Peter Groche and Nassr AlBaradoni 


The classic approach to deal with uncertainty in mechanical load-bearing structures 
is to oversize the structure by taking into account a safety factor, see Sect. 1.2. Uncer- 
tainty in load-bearing structures can occur for a wide range of reasons. Typical causes 
are material imperfections, geometric inaccuracies or inaccurate assembly. Sources 
of uncertainty in mechanical engineering prevail preferentially at joints. Here, dis- 
continuities in material behaviour or discontinuous force flow occur and lead to 
uncertain load scenarios. Therefore, the design and manufacturing of joints has to 
be carried out carefully. Bolted connections require special attention since the loads 
acting on the fastener can be multidimensional [121]. Smart load-bearing structures 
and machine elements contribute significantly to reducing the existing uncertainty. 
With the possibility of monitoring the actual load conditions and reacting accord- 
ingly, see Sect. 6.3 , oversizing can be avoided, resources be conserved and economic 
efficiency be increased [263]. Furthermore, the acquisition of process variables, e.g. 
process forces and torques, at the machine structure enables to verify the models of 
technical processes. 

Smart structures comprise structures with built-in sensors and/or actuators linked 
via a controller [43]. So far, load-bearing structures and sensors or actuators are 
separately manufactured and assembled in a further process [48]. In this section, we 
present a novel approach for the production of smart tubular metal structures through 
joining by forming. The approach allows for the production of different designs of 
smart structures and machine elements. The sensory bending dumbbells, drive shaft 
and fastening element in Fig.5.26 are some examples of possible smart structures 
created by this approach. 


sensory drive shaft 
I 


u er 


5 mm 
sensory fastener 


40 mm 


Fig. 5.26 Examples of sensory structures produced by integrating transducers into metallic load- 
bearing structures 
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Fig. 5.27 a Swaging unit [49], b motion sequence of the dies and e aluminium tube with integrated 
piezo ring 


These structures can be used in a growing range of applications due to ongoing 
digitalisation. Exemplary applications such as structure condition monitoring, load 
path analysis or lifetime estimation can be realised. Furthermore, smart structures 
can be used for process monitoring, allowing control approaches which boost effi- 
ciency and improve product quality. This approach offers many advantages. On the 
one hand, the manufacturing process is highly economical, since the functional mate- 
rial is integrated into the load-bearing structure during its shaping. Thus no further 
process steps are required. On the other hand, this integral joining ensures that the 
sensitive functional materials are protected from external influences, thus enhancing 
the lifespan of these materials. 


The joining process 


The novel manufacturing process for the creation of smart structures is based on join- 
ing by forming. The load-bearing structure is plastically deformed, resulting in a form 
and force-fit joint between the structure and the integrated functional materials [135]. 
For this joining operation, rotary swaging appears to be particularly suitable, as it is 
an established process for joining metal wires and bushings [263]. In this process, 
the cross-section of the workpiece is incrementally reduced by the forming dies, 
allowing the functional element to be integrated into the metallic structure. In order 
to prevent any damage of the functional element during integration, metallic end 
caps are used [134]. The integration of a piezo ring in a metallic tube by the recess 
swaging process is shown in Fig. 5.27. 

Figure 5.27 shows three of the four dies of the rotary swaging unit, which oscillate 
simultaneously at 30 Hz in the radial direction. While the workpiece rotates, the 
dies move closer to each other in the radial direction, see Fig.5.27b, leading to an 
incremental reduction in the tube cross-section [123]. The piezo ring is guided and 
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Fig. 5.28 a Process design transducer 
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placed through the groove on the inner surfaces of the dies. During forming, the 
tube material flows to the end caps on the left and right and pretensions to the piezo 
ring [134]. This pretension defines the working range of sensory structures, as it will 
be reduced under tensile loads on the structure. It also ensures the functionality of 
piezoelectric actuators since they require a certain preload for the operation. 

An adaptation of the process for the production of smart structures with homo- 
geneous outer diameters is presented in [121]. Figure5.28 shows a spring element 
with four strain gauges SG1-4 applied to measure temperature, force and bending 
moments integrated into a screw-shaped structure. Due to the preform of the struc- 
ture and the geometrical design of the spring element, the radial motion of the dies 
leads to the integration of the transducer in pretension, see Fig. 5.27. In a downstream 
process, the fastening head and the threads can be machined [121]. 

Unlike the process presented in Fig. 5.27, the final structure here has a uniform 
radius over the whole length after the integration process. For more flexibility in 
adjusting the pretension on the integrated functional materials, the integration process 
was extended to be based on in-feed rotary swaging. Through this extension, a better 
control of the pretension at the integrated functional material is achieved and an 
elongation of the joining zone is avoided [135]. 

At the first step of this integration process, the inner and outer preform is created 
in the structure using mandrels as well as the die geometry. In the second step, the 
functional material is inserted into the tube and pressed by the mandrel. As soon as 
the dies leave the integration zone, the mandrel is removed and the rest of the tube 
is further formed, as shown in Fig. 5.29. 


Summary 


It can be summarised that the introduced approach for the creation of smart structures 
and smart machine elements has many advantages, e.g. economic efficiency in pro- 
duction and the protection of integrated functional materials against environmental 
influences. The main characteristic of the presented integration process is the pre- 
tension of integrated functional materials. This pretension ensures the functionality 
of both integrated sensors and actuators. While integrated piezo actuators, e.g. need 
this pretension for the operation, the force measurement range of the tensile load of 
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the sensor structures depends directly on the value of the pretension. As has been 
shown in the integration process based on in-feed rotary swaging, smart structures 
can be produced in various designs and with a flexibly adjustable pretension. They 
can also be produced as semi-finished products for further processing or individu- 
alisation stages [180]. In this way, sensory structures can be used for strategies to 
reduce uncertainty in many applications in mechanical engineering, e.g. structural 
condition monitoring. 


5.3.5 Process Controlling During the Production of Smart 
Structures 


Peter Groche, Nasssr AlBaradoni, and Martin Krech 


The approach presented in Sect. 5.3.4 for the production of smart structures by means 
of forming technology allows the simultaneous joining of functional materials, as 
well as the forming of load-bearing structures and machine elements by rotary swag- 
ing [121, 134]. The functional elements are integrated into metallic hollow tubes by 
preload, which is created by a form- and force-fit joint. As a characteristic of the 
applied process, the functionality of the integrated functional elements, e.g. a force 
transducer, depends directly on the level of preload. A too high preload can damage 
the functional element, too low ones can prevent reliable operation. Considering the 
process design in Fig.5.29, deviations in the integration process, as generally dis- 
cussed in Sect.3.2 for process chains, can be expected. Stochastic data uncertainty 
in the properties of semi-finished metallic tubes as well as in the process model (see 
Sect. 1.6) lead to a deviation in the adjusted preload, as this preload largely depends 
on the material flow at the end caps of the integrated functional element [180]. In 
order to master the described uncertainty in the production of smart structures, an 
approach for process monitoring and process control is necessary and is described 
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Fig. 5.30 Measured force during the integration process, adjusted preload, forming strokes and 
resulting preload after thermal shrinking 


in the following. For this purpose, the force transducer to be integrated is calibrated 
and then integrated into the tube. In this way, the inline measurement of the actual 
preload can be achieved. 

Figure 5.30 shows the force signal curve measured by the integrated axial force 
transducer during the integration process 

As can be seen in Fig. 5.30, a certain preload of about 1.5 kN is adjusted at the 
beginning of the integration process. Subsequently, the dies start the forming process. 
With each stroke of the oscillating dies of the rotary swaging machine, the tensile 
force in the tube and the integrated transducer increases. Due to uncertainty in the 
integration process caused by thermal shrinking, fluctuation in the coefficient of 
friction, misalignment of components as well as geometrical deviations of the tube, 
a control approach to adjust a specific preload based on the measured signals of the 
integrated force transducer must be implemented [180]. 


The control approach 


Since the preload changes during the integration process and the remaining preload 
are only set after thermal equalisation, the control of the preload must be performed 
before the required information is fully provided [181]. A prediction model of the 
integration process seems to be suitable for this purpose. For the investigation of 
the preload evolution over the integration process, the time ¢; with the maximum 
remaining preload force was determined. Besides this reference point, three further 
time points with fixed time shift were also considered: t = tı + 0.75, and t; = 
ti + 1.25s and t4 = t; + 1.5s. For all these discrete points, a correlation coefficient 
r according to Bravais/Pearson is determined to describe the degree of correlation 
of the preload between 12 specimens in their time values and the remaining preload 
at the end of the process [181]. 
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Fig. 5.31 Measured force during the integration process and correlation analyses of preload evo- 
lution of 12 specimens [181] 


It can be seen in Fig. 5.31 that the correlation increases towards the end of the 
process. The later the preload force is evaluated, the better the quality of the pre- 
dicted remaining preload F,em,ena. From time fz on, the correlation factor r is at least 
79%. For the three discrete points during the forming process Frem (t2), Frem(t3), 
Fem (t4), a continuously improved correlation with the remaining preload Frem,end 1S 
observed [181]. 

Two process parameters exist on the experimental machine (rotary swaging), the 
process parameters of which can be manipulated during the forming process, and 
they also have a major influence on the preload force: the mandrel force Fmana and the 
in-feed speed v. On the one hand, it has been shown that the short contact effect of the 
mandrel, with the progress of the process, reduces the ability to affect the resulting 
preload. On the other hand, the in-feed speed has a better effect on the resulting 
preload, since it directly affects the forming forces and therefore the material flow 
at the end caps of the integrated force transducer [181]. For this reason, the in-feed 
speed is used as a manipulation parameter for the controller approach. 

Based on the trials conducted in [181], the following conclusion can be drawn: 
in order to obtain the widest possible range of achievable preload forces, the in- 
feed speed must already be adjusted at t = 2s. At this time, the process can be 
influenced most effectively (Fig.5.32). However, the highest possible accuracy of 
the predicted preload is only given in the time range between t = 2.5s and t = 3s 
(see the correlation value in Fig. 5.31). In order to meet both, the requirement for high 
accuracy and the requirement for a wide control range, the selected control approach 
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consists of three stages: An open-loop control, an early preload pre-control between 
t = 2s and t = 2.5 s with the aid of the prediction model and a subsequent adaptive 
control for fine adjustment starting from t = 2.5 s. The in-feed speed is manipulated 
with the aid of a feed-forward parameter from t = 2 s according to the target preload 
value. The adjustability of the preload at this point is the highest (see Fig. 5.31). At 
t = 2.5 s the signal can be fedback to the controller. The predictability at this point 
is high enough to fine-tune the process while still providing good adjustability. The 
control approach therefore consists of the three phases: Open-loop control, preload 
pre-control and feedback control (see Fig. 5.32). 

After designing the controller and the prediction model based on the correlation 
analysis in Fig. 5.31, sensory structures with controlled preload can be produced. 
Once the integration process has begun, the prediction model starts analysing the 
force peaks and valleys of each die stroke, with referencing the measured data to 
the reference point tı. The controller works in open-loop mode until time t2. The 
in-feed speed in this mode has a constant value vı. From time fz, the in-feed speed 
is adjusted to v2 according to the preload control parameter. In the last step, at point 
t3, the feedback control is activated and the in-feed speed is set to v3. The results 
of this control strategy were evaluated at two different force levels to investigate the 
flexibility of this approach. A significant increase can be observed in the achievement 
of the target preload force (Fig. 5.33). The repeatability is also increased in compar- 
ison to the uncontrolled processes. The accuracy and repeatability of the controlled 
process are increased at higher preload forces. These results prove that the inline 
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measured signals can be used to control the preload of the integrated transducer of 
smart structures, resulting in a higher accuracy and a smaller deviation. 


Summary 


Utilising the force signal of the transducer to be integrated for process monitoring 
and process control in the production of smart structures can significantly reduce the 
process-related fluctuations in the produced parts. Through correlation analysis, the 
resulting preload, which is directly measurable only after the process, could already 
be predicted in the second part of the forming process. In addition, it could be shown 
that it is possible to change the preload without affecting the resulting form of the 
smart load-bearing structure. Using the developed control approach, the fluctuation 
of the achieved preload force could be reduced by up to 60%. 


5.3.6 Process-Integrated Calibration of Smart Structures 
Nassr AlBaradoni and Peter Groche 


Smart structure and machine elements contribute to reduce uncertainties in mechan- 
ical engineering. With their abilities to monitor and react to the current load state, 
approaches for active process manipulation can be implemented. In Sect. 5.3.4, we 
discussed the efficiency in the production of smart structures by means of forming 
technologies. Process design for the integration of functional material into metallic 
tubular structure by rotary swaging is presented in [121, 127, 133]. An approach to 
deal with stochastic data uncertainty in the properties of semi-finished metallic tubes 
by controlling the joining process is presented in Sect.5.3.5. Despite the efficiency 
achieved in the manufacturing process, the required time consuming downstream 
calibration process is still a limiting factor for a broad industrial implementation of 
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Fig. 5.34 Measurement setup for the process-integrated calibration of smart structure produced by 
rotary swaging [6] 


sensory structures. Defined test sequences are carried out on a testing machine, for 
example, according to the standard DIN EN ISO 376 for force sensors in [70]. 

In this section, we present an approach to increase the efficiency in the produc- 
tion of sensory structures. By means of a suitable setup and process-adapted signal 
processing, it is possible to replace standard time-consuming downstream calibra- 
tion processes with process-integrated calibration [6]. Once the sensory functional 
element is firmly integrated into the structure and the forming dies leave the joining 
zone (see Sect. 5.3.4), the process forces required for the subsequent forming of the 
structure can be used to implement a dynamic calibration of the sensory structure. 
For this purpose, a special sensory clamping was designed as a machine-side refer- 
ence point. By measuring the forming forces in both modes, namely in the integrated 
sensor element and at the machine-side reference point, a calibration is realised as 
shown in [6]. For the sensory clamping, strain gauge sensors are applied to measure 
the axial force on the clamping surface. Due to the rotation of the clamping, signal 
amplifiers with wireless signal transmission are used (measuring nodes). The mea- 
surement setup in Fig. 5.34 contains the integrated strain gauge based axial force 
sensor within the tube and the two other machine-side axial force sensors on the 
clamping rotated 90° to each other for higher accuracy. 


Signal processing 


By looking at the force signals Fax tube and Fax clamping In Fig. 5.35, the manufacturing 
process can be divided into three phases. In the first phase, a certain compressive 
force is applied to the integrated force transducer by the mandrel to adjust the required 
pretension. The mandrel force remains until the forming dies leave the joining zone 
and the transducer is firmly joined into the structure. Once the transducer is fully 
integrated into the structure, the mandrel is removed and the rest of the tube is 
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Fig. 5.35 Progression of the axial forces both in the integrated force transducer and in the sensory 
clamping during the manufacturing process (normed to the max values) and the beginning of the 
calibration phase [6] 


pulled out of the swaging unit and formed by in-feed rotary swaging, see Sect. 5.3.4. 
As a result, the load direction changes and a high tensile force peak is induced 
with every stroke of the oscillating dies. At the beginning of the forming process 
(18s < t < 40s), ahigh forming frequency (approx. 30 Hz) leads to a high density of 
these force peaks. After the cooling-down of the joining zone in the tube, the adjusted 
pretension almost reaches a constant value (see also Fig. 5.34) and the dynamics of 
the forming dies are reduced to avoid resonance effects of the clamping [6]. The 
calibration phase can begin accordingly. 

Even after the identified time to start the calibration, both force signals Fax tube 
and Fx clamping are affected by two significant interferences: On the one hand, the 
high temperature at the integrated transducer caused by the plastic deformation of 
the tube leads to a drift in the force signal Fx tube. On the other hand, the eccentricity 
of the clamping during rotation causes a sinusoidal zero-point drift in both signals. 
Once forming starts, the sinusoidal zero-point drift becomes greater as a result of 
bending the tube by the oscillating dies, and it becomes less uniform as a result of the 
high forming moments causing the workpiece to slip, see also [6, 180]. Since neither 
the amplitude nor the angular frequency of the sinusoidal zero-point drift can be 
modulated, as the deformation behaviour is not precisely predictable, it is necessary 
to elaborate suitable approaches for the signal processing prior to calibration [6]. 
Based on the main characteristics of the incremental forming processes, i.e. that 
a release state occurs after each load state, an approach to correct the signals is 
introduced in [6]. The actual position of the zero-point in each signal is determined 
and then forced to the nominal position [6, 180]. Firstly, the lower envelope in each 
signal is determined. Secondly, the lower envelope is filtered by using a Gaussian 
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Fig. 5.36 Signal processing and correction: a raw signal, b the lower envelope (grey) and the 
filtered lower envelope (black), e force signal after correction the zero-point drift [6] 


smoothing filter to get a clear zero-point drift curve. Finally, the raw signal is corrected 
with the determined zero-point drift curve. Figure 5.36 illustrates this procedure. 

Figure 5.36a shows that the initial signal has a constant zero offset, as long as the 
clamping fixture does not rotate (t < 2s). Once the rotation starts (t > 2s), small 
sinusoidal zero shifts with relative constant amplitude and angular frequency occur 
(t < 10s). This drift is caused by the gravitational force of the mass of the structure. 
When the deformation begins (at t = 10s), the amplitude of the sinusoidal drift 
becomes higher with non-uniform angular frequency, which can be observed clearly 
in Fig. 5.36b. Once the signals are corrected, an accurate zero-point position can be 
observed, see Fig.5.36c and the calibration can be carried out by correlating both 
signals from the integrated force sensor and the sensory clamping. 


Results 


To determine the achievable accuracy of the in-process calibration, the gener- 
ated sensory structures were re-calibrated according to the standard calibration 
(DIN EN ISO 376) on a tensile testing machine (Zwick Roell 100). A compari- 
son between the two types of the calibration shows a good correlation. In Fig. 5.37, 
both calibration methods are shown for an exemplary sensory structure. While the 
nominal force rises gradually in a standard calibration, it usually reaches the nominal 
value in less than one second with one stroke of the forming dies. Both calibrations, 
however, show good linearity, allowing the calibration coefficient to be calculated as 
the slope of the linear fit of the measured points. By evaluating the deviation of the 
process-integrated calibrations from the reference in several samples, a maximum 
nominal value-related deviation of 2% was observed. 
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Fig. 5.37 Comparison of process-integrated and standardised calibration of a sensory structure 
with integrated axial force sensor and the calibration value-related deviation [6] 


Summary 


The novel approach, introduced in Sect.5.3.4, for the creation of smart structures 
through integration of functional materials in load-bearing structures using incre- 
mental forming processes provides numerous economic and functional advantages. 
By means of the possibility of process monitoring (see Sect. 5.3.5) during the integra- 
tion of the functional materials and, therefore, the realisation of control approaches, 
this manufacturing process gains the flexibility to adjust the pretension of integrated 
functional materials as a further advantage. 

A further benefit of incremental forming for the production of smart structures 
could thus be demonstrated. Since the incremental process implies that every loading 
state is followed by a release, the acquired data can be easily processed and process- 
related interference effects can be corrected. 

In a nutshell, smart structures with integrated functional elements help to master 
uncertainty in mechanical structures in their usage phase. By inline process mon- 
itoring and process-integrated calibration of smart structures, uncertainty in their 
manufacturing is reduced. Faulty integration processes can be detected, e.g. by eval- 
uating the standard deviation of the process-integrated calibration [6]. 
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5.4 Semi-active and Active Process Manipulation 
Maximilian Schaeffner and Christopher M. Gehb 


In the preceding Sects. 5.1, 5.2 and 5.3, we presented both, methods and technologies, 
to master uncertainty in the design and production phase of mechanical engineering 
structures; such methods and technologies are motivated by the cross-phase treatment 
of uncertainty, see Sect.3.1. This section is focused on the application of methods 
and technologies to semi-actively or actively manipulate processes and thus master 
uncertainty within the production and usage phase. In this context, we adhere to the 
definition of semi-active and active processes given in Sects. 3.2 and 3.4, according 
to which additional energy for actuators is introduced into a structure to either change 
or control mechanical properties, such as stiffness or damping (semi-active), or to 
directly influence a process, e.g. by force generating actuators to reduce vibrations or 
stabilise equilibrium conditions (active). The first half of this section covers the semi- 
active and active process manipulation of production processes by innovative tools 
and controllers to master uncertainty within the production phase. We present the 
active control of press stiffness, see Sect.5.4.1, state control with semi-active roller 
and plain bearings, see Sect. 5.4.2, and a sensor-integrated compensation chuck con- 
trol for tapping, see Sect. 5.4.3. In the second half of this section, uncertainty within 
the usage phase of mechanical load-bearing structures is mastered by semi-active 
and active technologies. We present technologies for vibration attenuation, such as a 
shock absorber with integrated hydraulic vibration absorber, see Sect. 5.4.4, an Active 
Air Spring, see Sect.5.4.5, and piezo-elastic supports in beam truss structures, see 
Sect.5.4.6. Furthermore, we introduce approaches for active buckling control, see 
Sect. 5.4.7, and semi-active load redistribution, see Sect. 5.4.8. 


5.4.1 Control of Press Stiffness 
Florian Hoppe and Peter Groche 


The functionally quality, cf. Chap. 1, of metal-formed products highly depends on 
the ability of the production machine to guide the tool accurately along a path. Since 
presses are subject to high loads, the exact positioning of the tool is challenging. Due 
to the elastic response of press components, variable loads lead to deviations in the 
tool path and thus in the product properties. Therefore, the press stiffness is one of 
the most important design parameters [79]. 

The press stiffness is defined as the ratio between a static load applied on the press 
ram and its deflection [68]. A common approach to modify the press stiffness is to 
adjust its design [80]. Numerous frame and gear designs that enhance stiffness have 
been established [79]. However, these also limit the accessibility of the working area 
[129]. Their focus is mainly on the stiffness in stroke direction, the torsional stiff- 
ness [68]. However, presses provide a degree of freedom exactly in stroke direction 
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by means of their main drives. Especially multi-point servo presses as the 3D Servo 
Press presented in Sect. 3.6.3 come with the advantage of providing multiple main 
drives. We present an alternative method of adjusting the stiffness by means of active 
process compensation. This method requires additional sensors and novel observer 
models to detect the ram deflection and makes use of the machine’s servo drives. 

Furthermore, methods to identify the stiffness have to be extended. Although the 
complete press stiffness matrix in all six spatial directions of the ram has already 
been investigated in science for hydraulic [12] as well as for mechanical [61] presses, 
so far the stiffness has only been considered in one operating point. This is based 
on DIN 55189-1 [68], which prescribes that the stiffness must be determined in the 
bottom dead centre. Numerical press models, e.g. finite element models, are often 
used in press design to evaluate the press behaviour, but can only be used offline due 
to their high calculation effort. However, elastic models are required for the exact 
determination of the ram position and its control. The extent to which reduced-order 
models are applicable for this task still needs to be investigated. This is addressed in 
the following. 

We evaluate the method at hand of the 10KN Version of the 3D Servo Press, a servo 
press that is able to move the three eccentric drives independently. The transmission 
ratio of all three eccentric drives can additionally be adjusted via the common spindle 
drives [239]. This also affects the force transmission, which is why the gear position 
must be taken into account when modelling the press stiffness [126]. Due to the 
variable force transmission, the load on the elastic machine elements changes. An 
additional shift in the joint positions due to the deflection and a progressive bearing 
stiffness result in a nonlinear stiffness model as described in Sect. 4.3.2. 

The compliance of the ram as represented by Chodnikiewicz [61] and Arentoft [11] 
can be described as a 6 x 6 press compliance matrix A. The deflection of the ram 
position at its tool centre point (TCP) under a given load vector / can be described 
by 


AXtep Ait Aı2 À13 Aig Aıs A16 

AYtep hat A22 423 Ana A25 A26 

Azıp | _ | A31 As2 Ass A34 Ass A36 | y (5.16) 
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AG, Ası A62 A63 Asa AGS Ass 

mn Sm m nn 
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with the translatory and angular displacements of the TCP Axtep, AYtep, AZtcp and 
A0,, Ad,, A@,, respectively. Since process forces occur mainly in the vertical z- 
direction, i.e. the stroke direction, the A;3 compliance must be reduced. Off-centre 
loads result in additional tilting moments that affect the ram tilting by means of the 
compliance parameters À;4 and A;s. 

The press compliance can be modelled by considering relevant machine compo- 
nents as trusses and beams [126]. Calculating A(q) at the current drive positions q 
allows to estimate the machine behaviour for control algorithms. The position vector 
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Fig. 5.38 Simulated compliance map of the 3D Servo Press prototype depending on the spin- 
dle configuration Zsu, Zsı at constant @ecc,i = 270° [126] 


q consists of the three eccentric drive angles Pecc,i, i € {1, 2, 3} and the upper and 
lower vertical spindle positions Zsu, Zsı. Since the compliance model is highly non- 
linear, we evaluated the model for different q. The compliance of 433 as a function 
of the upper and lower spindle positions Zsu, Z is shown in Fig.5.38 for constant 
eccentric angles Qecc,; = 270°. The operating area of the spindles is limited by the 
installation space and the singularities of the spindle kinematics. Figure 5.38 shows 
that the compliance strongly depends on the position of the spindles. The respective 
position of the spindles is visualised exemplarily by the corresponding kinematics. 
To investigate the dependence of press compliance 433 on the eccentric position, 
three spindle positions 1, 2, 3 with significantly different compliance were chosen. 

Figure 5.39 shows a comparison between simulated and experimentally deter- 
mined compliance A33 as a function of the eccentric angles @ecc,, for the spindle 
configurations 1, 2, 3. Apparently, the compliance also strongly depends on the 
eccentric position and therefore cannot be assumed to be constant. The deviation 
between simulation and experiment indicates uncertainty. Stiffness parameters are 
based on the nominal values of geometric parameters, such as cross-sections and 
lengths, as well as material parameters. These parameters are subject to manufactur- 
ing tolerances which are propagated into the model as data uncertainty. Furthermore, 
the model order reduction simplifies the model and hence increases model uncer- 
tainty. How this uncertainty can be evaluated and reduced is described in Sect. 4.3.2. 
Nevertheless, the reduced-order model is already able to represent the variability of 
the compliance and is valuable for the online control. 
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Fig. 5.39 Comparison of simulated (lines) and experimentally (cross markers) determined com- 
pliance of 433, depending on the eccentric positions Qecc,;_ [126] 


In [126] we designed an experimental setup to identify compliance matrices of 
both, the passive and the active system, Ap, A, respectively. The test setup allows 
a variable load vector / to be applied at the ram TCP and the ram displacement Ap 
to be determined at the operating point grep (Fig. 5.38). In n = 18 measurements, 
we applied 30% of the nominal force with a pneumatic cylinder and measured the 
displacements and rotations of the ram TCP with dial gauges. 


In comparison to the model-based estimated compliance matrix Ap the measured 
passive compliance 
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results. The bold highlighted entries correspond to the degrees of freedom of the 
control Ztcp, Ax, Oy. 

The control of the machine requires, on the one hand, a kinematic model f (q) for 
the control law [161] and, on the other hand, a model of the ram fam (D,) in order to 
estimate the ram position by means of the integrated displacement sensors D, [126]. 
By extending the rigid-body model of the press to the elastic model, the estimation 
accuracy of the ram position p can be enhanced. As a position feedback in the press 
is used, it is helpful to split the press compliance models at the measuring position 
into the gear and the ram 
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the measured deflection in the press gear Ds is used to estimate the actual ram 
position p. All model assumptions and measured variables are indicated by Ô, as 
they are subject to uncertainty. Section 6.1.7 investigates how data and measurement 
uncertainty affects this closed-loop control and how to design a robust control. 

The active press system compensates deviations detected in D,, which are caused, 
among other things, by the gear compliance A gear. In addition, the observer also takes 
into account the ram compliance Aram, which cannot be measured in the process. 

For the active system, we measured the press compliance matrix as 
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Since only the degrees of freedom z;cp, 0x, 0y are controllable, only the correspond- 
ing lines Az ;, A4,i, As; can be modified. While especially 33, A44, Ass have been 
reduced significantly compared to Eq. (5.17), other entries remain almost unchanged. 
However, it is noteworthy that A33 has a negative value, which means a displacement 
against the load direction. A negative stiffness is physically uncommon at first, but it 
is a characteristic of active systems, such as active suspensions (Sect. 3.6.2). In this 
case, the compliance model overestimates the actual compliance at this operating 
point and thus overcompensates it. 

In order to increase the mechanical stiffness of presses, so far the press design 
has been adjusted. In contrast, an active process manipulation method has been 
presented to increase the stiffness by means of closed-loop control. This method 
requires control capabilities which multi-point presses already provide by using their 
main drives. Therefore, no additional force generating actuators are required. The 
precise measurement of the ram position is the main challenge. As direct tactile 
measurement is infeasible, a robust sensor positioning must be carried out at a distant 
position. This results in the need for observers that can determine the ram position 
from spatially distant measurements. For this purpose, we developed a reduced-order 
elastic model and included it in an observer. Comparing active and passive systems 
we have shown that the use of control loops and reduced compliance models allows 
an exact ram positioning and thus a significant reduction of the compliance. 


5.4.2 State Control of Combined Roller and Plain Bearings 
Daniel Martin, Julian Sinz, and Peter Groche 


The development of industrial production plants is characterised by the demand 
for high productivity and optimal material utilisation. Especially in forming tech- 
nology, which is characterised by high investment requirements for machines, the 
trend therefore goes towards flexible machine technologies with a wide range of 
applications and high adaptability to multiple production conditions, which makes 
it possible to master uncertainty occurring in the production process (see Sect. 1.2) 
and the resulting fluctuations in product quality. 

Pioneers of such a machine technology are servo presses with an almost freely 
adjustable motion kinematics of the ram, thus rendering optimised motion and speed 
sequences of the tools possible. Due to the almost speed-independent nominal torque 
of servo motors, servo presses can be used to achieve high accelerations, as well as 
standstills under high loads [245]. This allows both, the application limits of presses 
to be significantly extended [214], and the cycle time to be reduced [130]. The 3D 
Servo Press presented in Sect. 3.6.3 is a prototype of this press technology, which is 
able to combine the flexibility of hydraulic presses and the economics of mechanical 
presses [202]. However, the increase in machine flexibility and the extension of the 
application limits also result in new, challenging load scenarios for the machine 
elements. Since these requirements can no longer be met by pure plain or roller 
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bearings, motor acceleration in servo presses is usually limited and, therefore the 
potentials of servo technology in presses cannot be fully exploited [245]. 

An existing problem in industrial practice is the lack of knowledge of the current 
condition of bearings and machines. Without this knowledge, the optimum time for 
maintenance or servicing cannot be determined exactly, which is why fixed main- 
tenance intervals are common in practise. This can lead to two different worst case 
scenarios: In the first case, maintenance is carried out at a time when it is not yet nec- 
essary, thus leading to rising costs. In the other extreme case, damage to a machine 
element occurs shortly after maintenance, whereby it is not immediately noticed and 
can therefore lead to consequential damage. Both cases can be avoided by continuous 
condition monitoring, which enables early damage detection. Sensor-based condition 
monitoring also provides the basis for preventing possible bearing or machine dam- 
age by implementing semi-active or active components. Thus, the operating limits 
of the machine can be extended and an extension of the service life may be achieved. 

Conventional, pure roller or plain bearings are usually only suitable for a part of the 
application spectrum of servo presses. Roller bearings offer a lower starting torque, 
but have poorer damping properties, and are generally not economically feasible for 
high operating loads [131]. Plain bearings, on the other hand, are subject to play, 
which increases the cost of control [131]. Furthermore, at low speeds, mixed friction 
occurs in plain bearings due to local deficient lubrication, which causes increased 
wear, especially in the oscillating stroke due to the constant changes in direction of 
motion. In order to meet the increased requirements for the bearings of the 3D Servo 
Press, we designed a combined roller and plain bearing combining the advantages of 
different conventional bearing types. Monitoring of the bearings’ behaviour is used 
to determine not only the bearings’ condition but also to draw conclusions on the 
current machine condition. Based on these findings, it is possible to actively control 
relevant bearing characteristics. 

The approach of combining both types of bearings in order to unite their specific 
advantages has been principally known for a long time [167, 207, 210, 222]. In the 
approach we present here, a plain bearing is complemented by two roller bearings 
arranged on both sides, which can be designed as cylindrical roller bearings or angular 
contact ball bearings. These hold the bearing shaft centrally in the plain bearing shell 
and reduce wear in the plain bearing during start-up [131]. This allows high loads 
to be transmitted and at the same time prevents backlash during start-up. Therefore, 
combined roller bearings offer great potential to meet the increasing requirements in 
the field of bearing supports for servo presses [245]. 

The structure of the combined bearing is shown in Fig.5.41. The bore diameter 
of the roller bearings is smaller than the one of the plain bearing. This results in a 
shaft shoulder on which the inner rings of the roller bearings abut axially. Radial 
play in the cylindrical roller bearing is eliminated by an interference fit between its 
inner ring and the shaft shoulder. If angular contact ball bearings are used, a variable 
preload of the roller bearings can be achieved by means of additional bearing caps. 
The plain bearing, which is supplied with lubricant via a bore in the bearing shell, 
can be preloaded by increasing the supply pressure [245]. 
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The combination of the three bearings creates a statically over-determined system, 
which makes a robust design necessary for industrial use. After the basic feasibility 
of combined roller and plain bearing arrangements was demonstrated in [240], we 
developed a design methodology that takes into account the distribution of the oper- 
ating force Fop between the roller bearing force F» and the plain bearing force Fy, 
as a function of the operating conditions. 


Simulation model and design methodology 


For the design and dimensioning of the presented bearing combination and for the 
estimate of operational safety, the force-path curve of the shaft is used to describe 
the dynamical behaviour of the bearing, resulting in the shaft displacement e(t). 
To determine e(t), we developed a simulation model according to [5, 270], which 
is grounded on the theory of hydrodynamic lubrication. The validity of this model, 
based on Reynolds [228], which is discussed in Sect. 1.3, is given for the investigated 
speed range of up to 400 rpm because of the small relative bearing clearance w of 
the developed bearing configuration in combination with high-viscosity oils. The 
shaft displacement e can be calculated by solving a differential equation based on 
the equilibrium of forces at the shaft according to Holland [158], which is extended 
by the effect of the rolling bearing forces [247] and allows to determine the load 
distribution on the various bearing components [130]. The force that a roller bearing 
exerts on the shaft is determined by means of the roller bearing stiffness c via 
F = ce. The overall stiffness ce of the combined bearing serves as an indicator 
to assess the functional capability of the bearing combination. 

The resulting simulation model enables not only the calculation of the shaft dis- 
placement path e(t) but also the determination of other relevant parameters, such 
as dynamic viscosity u, relative bearing clearance w, eccentricity £, lubricant tem- 
perature 3 and volume flow Qin. The results are validated using an example plain 
bearing from [75] and experimentally determined force- and speed-dependent dis- 
placement of the bearing shaft in the plain bearing shell of the combined bearing. 
The validated model forms the basis of the design methodology, which is presented 
in the following. 
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With the help of the developed simulation, a sensitivity analysis was performed 
in [247] to identify the relevant influencing parameters in the design of the com- 
bined bearing. The load ratio, which describes the distribution of the operating force 
between rolling and plain bearings, is of particular interest. Roller bearings are suit- 
able for operating at lower load and speed, since they have smaller load capacities 
than plain bearings of the same dimensions. For this reason, a load ratio Fyy/ Fi» > 1 
is favourable at higher speeds and loads in the interest of operational safety. As a 
result of the performed sensitivity analysis, the stiffness of the roller bearings Crv, 
the relative bearing clearance y and the lubricant viscosity 7 can be identified as the 
main influencing variables. The total stiffness Ce of the bearings increases linearly 
with increasing speed. Based on these findings, a design methodology for combined 
bearings can be developed. This is divided into the three steps pre-dimensioning, 
calculation and verification, which are carried out in an iterative process [247]. 


Sensor-based condition monitoring 


In order to quantify the industrial benefit of the presented bearing combination, we 
developed a test rig in [247], which enables the condition monitoring of a sensor- 
equipped bearing during operation. This allows continuous testing and evaluation 
with regard to defined technological and economic criteria and comparison with 
conventional bearings. The application and load limits of the combined bearings and 
their emergency running characteristics are determined. 

Figure 5.42 shows the developed sensor-monitored bearing. To detect the shaft 
displacement path e(t) in the plain bearing, the test bearing is equipped with two 
eddy current sensors arranged at 90° to each other, which serve to detect the position 
of the shaft. Three temperature sensors measure the temperature on the outside of 
the roller bearing outer rings and the outside temperature of the plain bearing shell. 
In order not to influence the lubricant film in the plain bearing, the lubricant film 
temperature is not measured directly in the plain bearing, but only the temperature of 
the lubricant escaping from the bearing in the oil tank of the test rig. The operating 
force, which is applied by a hydraulic actuator via the housing on the opposite of the 
pressure inlet, is recorded by means of a piezoelectric force transducer. The oil supply 
pressure is recorded via a pressure gauge attached to the inlet. The accelerations that 
occur during operation are measured by a triaxial acceleration sensor mounted on 
the outside of the bearing bracket. 

The radial displacement of the shaft in the plain bearing is assumed to be equal to 
the displacement in the roller bearings, neglecting any elastic deformation of the bear- 
ing housing or shaft in contact with the rolling elements. The stiffness of the rolling 
elements c, is assumed to be constant in the circumferential direction. The force 
F», which is discharged via the plain bearing, results from the difference between 
the measured operating force Fop and the roller bearing forces. With knowledge of 
the individual bearing forces, the operating behaviour and service life of the bearings 
can be estimated [247]. 
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For this purpose, tests are carried out in full rotation and in pivoting operation 
mode to investigate the influence of the speed and radial displacement of the shaft 
on the overall stiffness of the bearing combination developed. The roller bearings 
are designed both as cylindrical roller bearings and angular contact ball bearings. 
During the test runs with various operating forces, it has been shown that in full 
rotation an increasing rotational speed leads to a continuously increasing load ratio. 
Above a certain speed, the plain bearing takes over the major part of the load and 
presses the shaft into the centre of the plain bearings, resulting in a higher resistance 
to load shocks at high speeds [247]. For the movement sequence in pivoting mode, 
a characteristic forward and backward stroke movement is used. The assumption of 
a constant roller bearing stiffness leads to a constant load ratio, so that the maxima 
of the forces of both bearing types are superimposed [247]. 


Semi-active manipulation of the bearing behaviour 


On the basis of the knowledge gained on the behaviour and design of combined roller 
and plain bearings, the following section considers possibilities for semi-active pro- 
cess manipulation (cf. Secti.3.4) during operation to react specifically to disturbing 
influences during operation. Two approaches are possible for this purpose: Firstly, a 
control of the feed pressure pin of the lubricant can be used to influence the bearing 
behaviour; Secondly, additional actuators can be integrated and used for an adaptive 
adjustment of the roller bearing preload. 

The lubricating oil supply pressure pin can be used to preload the combined 
bearing via the plain bearing. The resulting preload can be interpreted as an increase 
in the effective operating force Fop, which leads to an increased radial displacement 
of the shaft. However, the effect on the overall stiffness of the combined bearing is 
small. It should be mentioned that in the calculation model described above, the outer 
rings of the roller bearings and the plain bearing shell are assumed to be concentric. 
Due to occurring inaccuracy during manufacturing and assemblage of the combined 
bearing, the centres of roller bearings and plain bearing do not match exactly in the 
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Fig. 5.43 Stiffness of combined bearings determined by carrying out experiments in full rotation 
mode, according to Sinz [246]: a roller bearings design as angular contact ball bearings, b roller 
bearings design as cylindrical roller bearings 


conducted experimental investigations leading to an initial displacement of the shaft 
in the plain bearing. 

In Fig. 5.43 the stiffness cop of the combined bearing is shown as a function of the 
rotational speed in full rotation operation for both angular contact ball and cylindrical 
roller bearings. The non-linear stiffness behaviour of the roller bearings leads to a 
non-linearity in the stiffness curves, especially at low speeds. If the speed is increased, 
the pressure build-up in the lubricant in the plain bearing gap centres the shaft in the 
plain bearing shell, which leads to an increase in the bearing stiffness. As the shaft 
displacement e in the bearing converges towards a very small value, the stiffness, 
determined by ce = Fop/e, reacts extremely sensitive to changes of e, resulting in an 
oscillation in the stiffness curves at high speeds. However, due to the better damping 
properties of the plain bearing, when increasing pin from | bar to 10 bar, the preload 
via the lubricant pressure causes both a smoothing of the stiffness curves and a lower 
standard deviation, which increases operational reliability [246]. 

The preload of the roller bearings has a decisive influence on the behaviour of the 
combined bearing in different load and operating conditions. As already described, 
the influence of the plain bearing increases continuously with increasing speed. In 
the case of a radial external load perpendicular to the shaft axis, this curve flattens out 
when a preload is applied to one or both roller bearings, so that the load ratio with 
increasing preload is below that of the non-preloaded condition. Conversely, this 
means that, depending on the external load, the load ratio Fy, / Fm can be increased 
in a targeted manner by reducing the roller bearing preload, i.e. the main load can be 
shifted to the plain bearing. 

The overall stiffness of the bearing, i.e. the resistance against a displacement 
of the shaft centre due to an applied operating force, grows with increasing speed, 
especially in full rotation mode, due to the higher load carrying capacity of the plain 
bearings. The stiffness can be additionally increased by preloading the roller bearings. 
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To make use of this knowledge, it is conceivable to equip the bearing with active 
components that can change the preload of the roller bearings during operation. The 
described effects could be validated in special tests. To change the preload, paraffin 
wax actuators were used. They were mounted between the bearing pedestal and the 
bearing covers. Through the supply of heat, a force is exerted on the outer rings of 
the angular contact ball bearings and thus reduces the preload [132]. 


Conclusion 


The combination of roller and plain bearings offers high potentials for the application 
in servo presses. Designed properly, the roller bearings bear the largest share of the 
load at low circumferential speeds and operating forces, while the plain bearings 
carry a larger ratio of the force with increasing speeds and loads. This load transfer 
has already been proven experimentally [131, 245]. 

In-depth investigations of the operational behaviour of the combined bearing and 
the evaluation of its industrial applicability have been carried out on a special test 
rig. Due to the resulting reduction of the roller bearing load in the combined bearing 
compared to pure roller bearings, the nominal lifetime of the roller bearings increases 
significantly despite a reduction of the required inner diameter. The use of combined 
roller and plain bearings is currently limited to prototypes, since the maturity for 
widespread industrial use is not yet given [131]. However, the potential resulting 
from the combination have already been proven [247]. 

Monitoring the operation state of bearings offers new potentials for the application 
in modern production machines. Examining a newly developed combined roller and 
plain bearing, we showed the possibility to use the bearings as both a sensor and 
actor in the drive train of the 3D Servo Press. Sensor-based condition monitoring of 
bearings allows conclusions on the current operation conditions of the press system, 
while the implementation of active components in the bearing makes it possible to 
influence the system’s behaviour depending on the particular load scenario. 

Condition monitoring makes it possible to detect detuned load conditions in the 
process, such as asymmetrical process forces, which can lead to ram tilting, as was 
shown in [132]. With the knowledge about their influence on the bearing stiffness, 
damping as well as the bearing clearance and load ratio of combined bearings, the 
controllability of the machine as well as the operating limits of the bearing can be 
extended by active bearing components, which leads to a reduction of tool wear, 
whereby a reduction of process uncertainty as well as an increase in component 
quality can be expected as well. 
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5.4.3 Development of a Sensor-Integrated Compensation 
Chuck for Semi-active Control of the Tapping Process 


Tuğrul Öztürk, Matthias Weigold, and Eberhard Abele 


The tapping process is a widely used machining process for internal thread mak- 
ing and usually takes place at the end of the value chain, so that non-compliance 
of required thread quality, or even the destruction of the thread due to uncertainty, 
is therefore associated with high economic costs [273]. Possible uncertainty during 
thread cutting are axis offset, concentricity error, synchronisation error, sloped pre- 
drill bore, faulty pre-drill bore diameter and tool wear [2, 185]. Here, we are facing 
two types of uncertainty both classified as incertitude. As introduced in Sect. 2.1 there 
is data uncertainty hidden in state variables, e.g. feed rate or motor spindle speed. 
Structural uncertainty as described in Sect. 2.3 results from the upstream process of 
machining the pre-drilling, since the tapping process is a combined process. In addi- 
tion to the methods and technologies to master uncertainty during the design and pro- 
duction phase presented in Chap. 5 an alternative strategy is the semi-active process 
manipulation described in Sect. 5.4. for mastering uncertainty during the production 
phase, Sect. 1.2. One of the core components of such a semi-active system for process 
manipulation are appropriate sensors to detect uncertainty. For the detecting of uncer- 
tainty within the tapping process, various approaches are being developed. In [185] 
and [266] the motor spindle currents were used as a data source to detect uncertainty 
while tapping by a two-stage pair-wise feature selection and classification algorithm 
based on wavelet transformations [185] and statistical process control [266]. The 
detection of progressive wear of an M12 tap by examining the frequency spectrum 
of vibration measurements of the workpiece and the motor spindle during tapping is 
shown in [200]. The authors in [60] and [188] used dynamometers as data source for 
diagnosis of the tapping process by using an information and multiple probability 
voting scheme [60] and artificial neural networks [188]. 

The company Bilz Werkzeugfabrik has developed a sensor-integrated tapping 
chuck which detects the occurrence of length compensation [39], thus resulting in 
a binary information only, which is not appropriate for semi-active control. In this 
subsection, we introduce the concept for a semi-active control of the tapping process 
on the basis of the length compensation chuck (LCC) Softsynchro 3 from the tool 
manufacturer Emuge Franken [88] shown in Fig.5.44a. This is a purely mechanical 
system for handling synchronisation errors only. The Softsynchro 3 consists of a hol- 
low shank taper with an attached hollow cylindrical part in which a piston clamping 
the tapping tool can move maximum 1.5 mm in both z-axis directions. Two pairs of 
axial ball bearings offset by 180° are guiding the piston and transmitting the process 
torque from the hollow shaft taper to the tapping tool. The axial system stiffness 
in z-axis direction is determined by two polymer spring elements offset by 180°. 
Further, we present three sensor concepts to measure the close-to-tool vibrations, the 
process torque and the axial length compensation for uncertainty detection during the 
tapping process, as well as the integration of these sensors into the LCC. Compared 
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Fig. 5.44 a Sectional view of Softsynchro 3 [88] and b modelling of stiffness 


to [185, 266], the process torque is measured directly on the LCC and not indirectly 
via the motor spindle currents. In comparison to [200], the vibration sensor intro- 
duced in this work measures the vibrations close to the tapping tool. The concept we 
present here to measure the axial length compensation is unique and allows to quan- 
tify the synchronisation error. The use of a dynamometer as in the approaches [60, 
188] is deliberately avoided, since dynamometers have a number of disadvantages, 
such as high costs and a smaller workspace. The three sensor concepts measure the 
corresponding measurement quantities close to the process and therefore provide 
an appropriate data source for semi-active control to master the uncertainty of the 
tapping process. 


Concept of semi-active control of the tapping process 


Within a semi-active control approach, the production process of tapping is not 
directly influenced by actuators but by the machine tool. In Fig.5.45 we present 
a schematic diagram of the setup and the functional principle for semi-active con- 
trol during the tapping process. To detect uncertainty while tapping, the LCC Soft- 
synchro 3 is equipped with the three sensor concepts mentioned above. For signal 
pre-processing, data acquisition (A/D converter) and data processing we developed 
a rotating telemetry unit. The data acquisition of the sensor data while tapping as 
well as the communication with the machine tool for semi-active control is made 
via the wireless radio standard WiFi. For mastering uncertainty while tapping by 
semi-active control, it is necessary to define appropriate control variables within the 
machining process containing process parameters, e.g. motor spindle speed and feed 
rate. Beside definition of such control variables by process parameters, it is necessary 
to influence them within the numerical control (NC) of the machine tool. As men- 
tioned in Fig. 5.45, the NC of the selected machine tool contains a OPC-UA (Open 
Platform Communications—Unified Architecture) server, which makes a commu- 
nication of the machine tool with other production machines possible. By linking 


326 P. Groche et al. 


machine tool DMC850v from the 
manufacturer DMG MORI 


PC / Server 


workpiece 
ee sensor data | 
S cutting a — 
i process numeric p: 
Ss A control 
OnT O 
.. phase 2 WiFi 
ic. 
' — B ...... R ' 
\ sensors signal processing A/D converter microcontroller / 


Softsynchro 3 with integrated sensors and telemetry unit 


Fig. 5.45 Schematic diagram of the semi-active control concept 


this ability with synchronised actions [244] within the NC program makes process 
manipulation during machining processes possible, since synchronised actions can 
influence process parameters synchronously to the NC program execution. 


Sensor integration 


A sensor concept has been developed to measure lateral vibrations close to the tapping 
tool shown in Fig.5.46a. The vibration sensor is screwed onto a sleeve which is 
glued onto the tapping tool, allowing a non-destructive use of the vibration sensor in 
case of tool breakage. Two accelerometers based on Microelectromechanical system 
(MEMS) measure the acceleration in x- and y-axis direction. The process torque is 
determined with a strain gauge full bridge, which for design reasons can only be 
applied to the outer surface of the cylindrical part (Fig. 5.44a) of the LCC. By means 
of a Finite Element Method calculation we localised the position of the maximum 
mechanical shear stress illustrated in Fig. 5.46b, and thus the appropriate application 
positions of the strain gauges. The measured strain £45 is converted into the process 
torque Mr by assuming a linear-elastic behaviour by Eq. (5.22) 


E n dt — dý 


Mr = s4 —— 
Fe I6 d, 


; (5.22) 
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Fig. 5.46 Integrated sensors in the LCC to measure a close-to-tool vibrations, b process torque 
and ce axial length compensation 


where d, is the outer and d; the inner diameter of the cylindrical part (Fig.5.44a), 
the modulus of elasticity is represented by E and the Poisson’s ratio by v. 

To measure the axial length compensation a sensor based on strain gauges has 
been developed shown in Fig. 5.46c. This sensor consists of an outer ring and an inner 
ring, which are connected by two webs. Due to this design, the sensor behaves like a 
spring element, whereby the spring stiffness is largely determined by the lower side 
of the two webs forming a full bridge configuration allowing a sensitive measuring of 
the strain due to displacement of the inner ring in the z-axis direction. By integrating 
the axial length compensation sensor into the LCC (Fig.5.44a) and connecting the 
outer ring with the bottom side of the cylindrical part (Fig. 5.44a) and the inner ring 
with the bottom side of the piston (Fig. 5.44a), the axial length compensation can be 
quantified indirectly. The original axial system stiffness mainly determined by the 
two polymer spring rings cp in Fig.5.44b is increased by the sensor stiffness cs in 
Fig.5.44b resulting in a new axial system stiffness which is given by 


CSystem = 2cp +cs (5.23) 


Therefore, the geometry of the sensor was designed in a way that the sensor stiffness 
cs is less than ten percent of original axial system stiffness cs < 0.2cp. 


Evaluation of the close-to-tool vibration sensor 


For evaluation of the vibration sensor, we carried out thread cutting tests with thread 
dimension M8 x 1.25 mm on a GROB G350 machine tool. The thread has the dimen- 
sion M8 x 1.25 mm and the material type 42CrMo4. The spindle speed was 9.7 Hz and 
the cutting speed 148.8 m/min. The vibration signals of both MEMS accelerometers 
while cutting a single thread are shown in Fig.5.47. It can be seen that each signal 
contains a constant acceleration component, on which a low-frequency harmonic 
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Fig. 5.47 Close-to-tool vibration signals during the cutting of a single M8 x 1.25 mm thread, sam- 
pled at 10.5 kHz and low pass filtered at 50 Hz 


oscillation of 9.7 Hz is superimposed. The constant acceleration corresponds to the 
centripetal acceleration, which is included in the vibration signals due to the measur- 
ing direction of the MEMS accelerometers in x- and y-axis, thus radial direction. In 
this case, the low-frequency harmonic oscillation corresponds to the spindle speed 
signal, because the machine tool used to perform the experiments is a horizontally 
mounted motor spindle. In this arrangement, the acceleration due to gravity is no 
longer perpendicular to the plane of rotation (x-y plane), so that the gravity is also 
measured by the MEMS accelerometers depending on the angle of rotation of the 
motor spindle. Since the two measuring directions of the MEMS accelerometers are 
orthogonal to each other, the harmonic components of both MEMS accelerometers 
caused by gravity are phase-shifted by 90° to each other. Furthermore, the reversal 
point of the tapping cycle can be seen in both vibration signals and is also marked 
in Fig. 5.47. 


Conclusion and outlook 


The evaluation of the developed vibration sensor provides plausible results, so that 
the measurement data of the vibration sensor can be used to detect uncertainty during 
tapping process. Next, the sensors for measuring the process torque as well as the 
axial length compensation must also be validated for plausibility and calibrated 
within thread cutting tests. Within the scope of further thread cutting tests, uncertainty 
during the tapping process, e.g. exceeding threshold values of corresponding process 
quantities measured by the integrated sensors have to be detected. Subsequently, 
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appropriate control variables are to be derived for the semi-active control of the 
tapping process and the control algorithm is to be implemented in the micro-controller 
of the telemetry unit. The presented technology enables the mastering of uncertainty 
of the tapping process within the production phase of mechanical components used 
in structural dynamic systems such as the MAFDS presented in Sect. 3.6.1. 


5.4.4 Shock Absorber with Integrated Hydraulic Vibration 
Absorber to Improve Driving Dynamics 


Nicolas Brötz and Peter F. Pelz 


A car driving on an uneven road is subject to vibrations that are handled by suspension 
struts similar to the MAFDS, see Sect. 3.6.1. Their main task is to reduce vibrations. 
This can be done by (i) passive elements like spring, damper and dynamic vibration 
absorber, (ii) semi-active systems like adjustable damper, and (iii) active systems, 
such as the Active Air Spring, see Sect.3.6.2. In the following, we focus on the 
usage of a passive dynamic vibration absorber, see Sect. 1.3, and discuss a semi- 
active option. 

The essential requirements for the suspension strut of modern vehicles are to 
ensure high driving safety and high driving comfort at the same time. The driving 
safety is affected by data uncertainty of the wheel mass and tire stiffness, which can 
be classified as incertitude, Sect. 2.1. A higher wheel mass, for example atire covered 
with mud, leads to a loss of driving safety. The driver’s control of the vehicle can 
only be ensured, if there is wheel-ground contact. The suspension strut links the car’s 
body to the wheel. The vertical suspension strut force, therefore, has to be sufficient 
to ensure the best transmission behaviour of horizontal manoeuvres. According to 
Mitschke [198], the driving dynamics are measured by the dynamic wheel load 
fluctuation. If the fluctuation is higher than the static load, the tire loses contact to 
the ground. Driving comfort is measured by accelerations on the occupants. The 
suspension strut as a link between body and wheel affects both, driving dynamics 
and driving safety. 

However, when tuning the system, these two objectives are in conflict. As an 
example, we consider a quarter-car simulation of a reference car with adjustable 
damper and a constant body spring stiffness using an excitation according to a fed- 
eral highway at 100km/h. The quarter car has the parameters of a middle class car 
also used in Sect. 3.6.2. As a reference for following investigations, the grey line in 
the conflict diagram in Fig.5.48 depicts the corresponding Pareto-front for varying 
damping coefficient, where the standard deviations are extracted from a time signal 
of wheel load and body acceleration. By increasing the damping coefficient, the body 
accelerations are also increased, whereas the wheel-load fluctuation decreases. 
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Fluid dynamic vibration absorber 


To improve upon this boundary, a structural expansion, a dynamic vibration absorber 
with ahydraulic translated fluid mass, the Fluid Dynamic Vibration Absorber (FDVA) 
has been developed [52]. Its advantages can be seen in Fig. 5.48. The black solid line 
shows the Pareto-front of the FDVA with damper. The dashed black line refers to 
the FDVA without damper. It can be seen that this more simple configuration is only 
useful when the comfort is neglectable, e.g. for sport cars. In combination with a 
damper the FDVA is able to reduce wheel load fluctuations with the same comfort 
compared to the reference. In the following, we present the design and operation 
principle of the FDVA, as well as the validation of the used models and the discussion 
of simulations leading to Fig. 5.48. 

A classic dynamic vibration absorber consists of a capacity and a heavy mass, 
which contradicts the goal of lightweight construction. In comparison to a classic 
dynamic vibration absorber, the Fluid Dynamic Vibration Absorber (FDVA) [52], 
reduces the dynamic mass by means of hydraulic transmission. By using the conti- 
nuity equation, Bernoulli’s equation and principle of linear momentum, the possible 
reduction of mass can be derived from the axiomatic model of the FDVA 


[mp + Qaß + a*)mp] Z = k(zo — z) + PLA (5.24) 


with the piston mass mp, the ratio a = A/a between the surface of the piston A and 
the ducts a, the relation of duct length to cylinder length £, the duct fluid mass mp the 
absorber motion z, the excitation motion zo, the vibration absorber spring stiffness 
k, and the pressure loss pr. 

Figure 5.49 shows the principle of lightweight design at the hydraulic transmis- 
sion. The duct fluid mass mr is transmitted by a”, which we see at the deviation 
between inertia and mass, if the piston mass mp moves towards zero. The ratio 


5 Methods and Technologies for Mastering Uncertainty 331 


yA N 
LT ge 
a 
a_ je l L 
z 4 B= T 
zt X 
k x mr = ola 
Z$ Zot 
}O} 
mass m mp + mp(2aB +1) 
2 
inertia 8 m mp + mr(2aß + a“) 
inertia 1 mp + me (Zaß + a?) 
mass Mp + mp(2aß +1) 


Fig. 5.49 Lightweight design: A comparison between standard dynamic vibration absorber and 
FDVA 
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Fig. 5.50 Sectional view of the FDVA functional demonstrator [52] 


a = A/a is determined by the geometry. The duct fluid mass mr is negligible in 
terms of weight, but translated it has the largest contribution to inertia. 

We built a prototype of the FDVA to validate the axiomatic model, Eq. (5.24), see 
Fig. 5.50. It consists of a double-acting hydraulic cylinder where the chambers are 
connected via twelve ducts on the outside. The ducts can be closed by mechanical 
valves in order to change the ratio œ. A spring connects the piston rod of the hydraulic 
cylinder with the wheel axle. The body spring is connected parallel to the FDVA and 
links the wheel axle to the housing of the FDVA, which in turn is attached to the 
chassis. 


FDVA model validation 


The characteristics of a dynamic vibration absorber are used to validate the axiomatic 
model. Therefore, we evaluate the transmissibility V and the phase shift y of foot 
excitation zg to piston motion Zppva at a frequency band with frequencies from 0.1 
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Fig. 5.51 Model validation with experimental results for the FDVA 


to 25Hz, since the quarter car, the basis of our investigations, is usually applied 
in this range [198]. We mounted the functional demonstrator into the Hardware-in- 
the-Loop test rig, see Sect.4.3.4 and open-loop-tests were conducted. The model, 
Eq. (5.24), was evaluated in [53]. Figure5.51 shows the results for the exemplary 
configuration of two opened ducts. Both, experiment and model, show a phase shift 
w = x /2 at 8 Hz. The spring stiffness is 57.400 N/m and the fluid mass mr is 1.6kg. 
The eigenfrequency w = 2r,/k/m, at 8Hz provides evidence that the inertia is 
translated. 


Improvement by use of the FDVA 


We use the validated model to estimate the improved driving dynamics. The quarter 
car, a simple dual mass oscillator, is equipped with the model of the FDVA. The three 
equations of motion for body (index B), wheel (index W) and FDVA according to 
Fig.5.50 are then 


mpt+(l+qa)2mp 0 — (a + a?) ME ZB b -b0 ZB 
0 mw 0 zw |+[-5 50 iw 
—(a+07)mp 0 [mp + (206 +07) mg] ZEDVA 0 00 ZFDVA 
kg —kg 0 ZB — pLaa 
+ kg kg + kr + krova —kepva zw = | krzo (5.25) 
0 —kFDVA kFDVA ZFDVA PLaa 
with mass m, motion z, damping coefficient b, stiffness k, tire stiffness kr and road 
excitation zo. The body stiffness kg contains the secondary stiffness of the suspension 
strut for a realistic simulation. These equations can be used to calculate the driving 


dynamics and comfort. For the FDVA with duct fluid mass of mr = 72 g translated 
by a translation factor of œ = 59.45 the results are given in Fig. 5.48. 
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For the FDVA with damper in the design point an increase to the reference car of 
5% in driving dynamic at a constant driving comfort is possible. The peak of wheel 
load fluctuation in the frequency response reduces by 15%. 

Now, we discuss the possibility to master uncertainty using the passive FDVA. 
The passive FDVA is designed to absorb the eigenfrequency of the unsprung mass, 
which is formed by the mass of break, wheel carrier, upper and lower control arm and 
wheel. The wheel mass depends on the brand and the wear condition and therefore 
is uncertain. 

The tire is another uncertain factor. While driving, the tire is able to heat up 
and the stiffness increases. Thus, the eigenfrequency of the wheel increases, too. 
Investigations show that in realistic changes of wheel mass, tire stiffness and road 
conditions the improvement through the FDVA in comparison to a standard shock 
absorber is independent of a change of eigenfrequency. 


Semi-active FDVA 


Compared to a passive FDVA, a semi-active FDVA is able to adopt its eigenfrequency 
to a change of the system’s eigenfrequency. A system’s eigenfrequency can variate by 
a change of inductance or compliance. In the case of a high system eigenfrequency 
change, e.g. for a sprung foundation, where the change of mass depends on the 
assembly of the test bench and thus can be in the range of several hertz, the semi-active 
FDVA is useful. For the adaptation to the system eigenfrequency the transmission 
factor « or the length of the duct and the damping of the FDVA has to be changed. 

The wheel of a car has only a small change of unsprung mass and tire stiffness, 
thus showing a neglectable system eigenfrequency change. The extra effort to design 
a semi-active FDVA for a car on the one hand is not necessary, and on the other hand 
is too expensive. 


Conclusion 


A standard shock absorber equipped with the passive FDVA is able to maintain 
the driving dynamics. This is equivalent to the driving safety in a larger area of 
application, when the road, tire or loading conditions of the vehicle are unknown. 
If we know the boundary of the parameter changes and can classify them with 
tolerances, passive systems can be sufficient. Semi-active and active systems require 
a higher effort, but they are able to adopt a wider range of parameter changes. 
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5.4.5 Active Air Spring for Vibration Reduction in Vehicle 
Chassis 


Manuel Rexer, Philipp Hedrich, and Peter F. Pelz 


In autonomously driven cars, passengers are able to spend time on activities other 
than driving [151, 248]. The highest possible level of driving comfort is increasingly 
important, as it is the case with today’s luxury class vehicles. The suspension system 
of the vehicle has the greatest influence on driving comfort [147]. When designing 
the spring and damper system, driving comfort and driving safety are two conflicting 
objectives [198]. It is not possible to optimise both at the same time, however, a 
compromise between the two is feasible. 

The simplest model for the vertical dynamics of a car is the quarter car intro- 
duced in Sect.3.6.2 [198]. With this two-mass oscillator, driving comfort can be 
evaluated by the standard deviation of body acceleration o;,. The standard deviation 
of the force between wheel and road øp, describes the driving safety. As shown in 
Sect.3.6.2 there are boundary lines, so-called Pareto lines, for passive suspensions 
consisting of springs and dampers which cannot be improved upon by any passive 
system. To further increase the driving comfort, active systems must be applied. The 
active system increases the function “driving comfort” of the vehicle. This gain in 
function can be used to master uncertainty that occurs during the usage phase of 
the entire system. The active suspension is able to compensate varying parameters 
(data uncertainty Sect. 2.1), e.g. a changed wheel mass. Since the distribution of the 
variation is not known, this is an incertitude. The active module is also able to mas- 
ter uncertainty in excitation as we show later in this section. Since the excitation is 
unknown in the design phase, this is ignorance. We have developed an Active Air 
Spring (cf. Sect. 3.6.2) to demonstrate the capabilities of an active suspension system 
[20, 147]. This subsection gives a short review on experimental results of the Active 
Air Spring which actively increases driving comfort compared to the passive system. 

All investigations are carried out on a hardware-in-the-loop (HiL) test rig 
(cf. Sect.4.3.4). Figure 5.52 shows the layout of the test rig, which consists of a 
uniaxial test rig that deflects the air spring and measures its reaction force. The 
dynamics of the quarter car and the controller of the active system are simulated in 
a real-time simulation (for parameters see Sect. 3.6.2). Hardware and simulation are 
connected via the deflection Az = Zp — Zw and the force measurement signal F. 

In principle, the quarter car can be excited by any base excitation z,. In the fol- 
lowing, the rides over (i) a single obstacle and (ii) on a road are examined. The ride 
over a single obstacle (i) demonstrates the active manipulation of the quarter car. 
The quarter car rides at a speed of v = 10 km/h over an obstacle created as a cosine 
shaped bump with a height of h = 5cm and a total width of / = 100 cm. Maximum 
driving comfort is reached, if the body is at rest (Z, = 0). It is to be taken into 
account that the controller has been designed for the stochastic excitations of a road 
and is not optimised for the crossing of a single obstacle. The excitation therefore 
is uncertain. This data uncertainty occurs in the use phase of the Active Air Spring. 
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Fig. 5.52 Basic layout of the hardware-in-the-loop test rig with signal flows 


Figure 5.53 shows the result of the HiL test for a passive and an active system. The 
time sequences of the excitation zr, the body movement z» and acceleration Zp, the 
wheel force fluctuation A Fw, the force between wheel and road and the deflection 
Az are shown. The results for the passive system were also determined with the HiL 
test rig, by deactivating the actuator. 

The active suspension system comes much closer to the target of keeping the body 
at rest than the passive system, since the body movements z, are smaller. The lower 
body acceleration Zp results in increasing driving comfort and the smaller wheel 
force fluctuation A Fw increases driving safety. It is possible to reduce the body 
accelerations by 53%. The active system requires more suspension stroke than the 
passive system, since the deflection Az increases. The deflection of the Active Air 
Spring is almost equal to the excitation, which is obvious, since the body is almost 
at rest. Hence, increasing driving comfort is only possible with larger suspension 
stroke. Furthermore, these results demonstrate that the designed controller is robust 
against ignorance in the excitation of the system. 

The ride on a road (ii) is examined by excitation with a stochastically generated 
signal. For this purpose, white noise n is filtered so that the contained spectrum 
corresponds to riding on a highway with 100km/h [147]. Figure5.54 shows the 
frequency response of the performance indicators driving safety Fw and driving 
comfort Z» during such excitation. Frequencies above 25 Hz are not considered, 
since they are negligible for chassis applications [198]. As before, the response of 
the passive chassis is used as a reference. 
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Fig. 5.53 Time sequences of the HiL test when crossing a single obstacle (J = 1m, h = 5cm, 
v = 10km/h) with the passive and the Active Air Spring controlled by controller with preview 
function 


It can be seen that the active system causes a significant vibration reduction in 
terms of driving safety and driving comfort in the range up to 5 Hz. In the range 
above 5 Hz no significant improvements are achieved. However, no deterioration can 
be seen either. The reason is the speed of the actuator which has a transfer function 
that corresponds approximately to a Ist order low pass filter with a cut-off frequency 
of 5 Hz [183]. At frequencies above 5 Hz, the influence of the actuator is therefore 
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Fig. 5.54 Frequency response of passive and active system from HiL test riding on a highway with 
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Fig. 5.55 Conflict diagram for driving safety and driving comfort of passive and Active Air Spring 
from HiL test riding an a highway with 100 km/h 


limited. However, it should be noted that the possible comfort margin above 5 Hz is 
also small. 

The conflict diagram, cf. Fig.5.55, shows the performance indicators, standard 
deviation of body acceleration o;, and wheel load of, / Fw,o in relation to the static 
wheel load can be shown in a comparative manner. Figure 5.55 shows the Pareto line 
for the passive and active system and the results for the passive and active chassis. 
The Pareto lines are the results of the H2 optimisation as shown in Sect. 3.6.2. 

The active system will increase comfort by 28% with loosing 4.7% of driving 
safety. The active system comes much closer to the active Pareto front. We have to 
consider that the results for both, the passive and the active system, are influenced 
by the HiL test rig (see Sect. 4.3.4). This degrades the test results in comparison to 
the limit lines which can be determined by simulating the influence of the HiL test 
rig. 

In summary, the active system is suitable for increasing driving comfort by up to 
28% while nearly maintaining the level of driving safety. The active system increases 


338 P. Groche et al. 


the function of the suspension system, which is not possible with a passive or semi- 
active system. Even when driving over a single obstacle, the actuator system isolates 
the chassis from the excitation. The active system is therefore able to compensate 
the uncertainty in excitation, which is limited in the case of a passive chassis. 


5.4.6 Vibration Attenuation in Beam Truss Structures 
Via (Semi-)active Piezoelectric Shunt-Damping 


Jonathan Lenz, Benedict Gotz, Tobias Melz, and Roland Platz 


Piezoelectric shunt-damping as a (semi-)active process manipulation, see Sects. 3.2 
and 3.4, is an alternative to tuned mass dampers or mechanical vibration absorbers and 
has been extensively researched by the scientific community in the past decades [104, 
118, 138, 199]. In piezoelectric shunt-damping, a piezoelectric transducer converts 
mechanical energy due to a system’s vibration into electrical energy that is dissi- 
pated in an electrical resistance shunted to the transducer. There are various possible 
shunts, which can be used for piezoelectric shunt-damping to attenuate vibrations in 
a narrow frequency band [199]. Therefore, they are to be tuned precisely to a system’s 
resonance frequency to achieve an optimal vibration attenuation [118, 199, 206]. If 
the shunt comprises an electrical resistance (R) and inductance (L), it is called an RL- 
shunt. It functions and is tuned analogously to a mechanical vibration absorber [206], 
but requires less space and additional weight. Adding a negative capacitance (C) to 
the RL-shunt results in an RLC-shunt [206]. A mathematical model of the system 
with shunted piezoelectric transducers, that adequately predicts the system’s outputs 
is required to tune the shunt parameters within a model-based approach. However, if 
data uncertainty occurs, see Sect. 2.1, e.g. due to a variation of model parameters or 
boundary conditions, the model output varies, which leads to detuned shunt parame- 
ters as well as to a decrease in the achievable vibration attenuation [118, 184]. In this 
section, we therefore discuss the effects of aleatoric and epistemic data uncertainty 
from different sources on the vibration attenuation of a single beam and a beam truss 
structure in the usage phase via piezoelectric shunt-damping, see Sect. 1.2. 


Uncertainty in vibration attenuation in a single beam test setup 


In [118], Götz conducted an extensive numerical and experimental study on the 
attenuation of lateral vibrations of a single beam at the first resonance frequency via 
piezoelectric shunt-damping. Figure 5.56a shows the corresponding single beam test 
setup with the slender aluminum beam / that is of the same design as the beams 
comprising the MAFDS described in Sect. 3.6.1. It is connected to a slide bearing 2 
and a fixed bearing 3 via the novel piezo-elastic supports A and B. A static axial 
load F,, can be applied to the beam using the spindle type lifting gear 4, which is 
measured with the force sensor 5. Support A is used to excite the beam in the y- 
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Fig. 5.56 a Single beam test setup, b sectional view and ¢ photo of the piezo-elastic support [118] 


and z-direction, while support B is shunted to an RL- or RLC-shunt to attenuate the 
lateral vibrations, which are measured by two accelerometers 6. Figure 5.56b shows 
the sectional view of the piezo-elastic support in Fig.5.56c, with the membrane 
spring B/ that restricts lateral and axial displacement but allows rotation of the 
beam’s end. Two piezoelectric stack transducers B2 are positioned opposite two 
helical disc springs B3 mechanically prestressing the stack transducers. Both are 
connected to the beam via the axial extension B4, which connects both springs to 
the beam, and transforms the beam’s lateral vibration into axial deflections of the 
stack transducers. The concept of the piezo-elastic support was patented in [91] and, 
apart from piezoelectric shunt-damping, is also used for active buckling control, see 
Sect. 5.4.7 [235]. 
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Fig. 5.57 a Experimental amplitude response |Gy| for axial tensile load Fax = —1200N (----), 
axial compressive load Fax = 1200 N (— —) and axially unloaded beam Fax = ON (——) without 
a shunt as well as with RL- and RLC-shunt and b normalised histogram of the numerically simulated 
maximum amplitudes Gy for RL- and RLC-shunt, according to [118] 


The single beam test setup in Fig.5.56a was designed to investigate uncertainty 
in the attenuation of lateral vibrations at the beam’s first resonance frequency via 
piezoelectric shunt-damping. An epistemic data uncertainty, see Sect. 2.1, is the vari- 
ation of static axial loads that results in a decrease of the first resonance frequency 
for compressive loads as well as an increase for tensile loads, [118, 120]. For the 
vibration attenuation via piezoelectric shunt-damping, the RL- and RLC-shunts were 
used. For that, the shunts were tuned to the unloaded beam. Figure 5.56a shows the 
experimental amplitude response |G,| from the beam’s excitation force at support A 
in y-direction to the measured acceleration in y-direction at accelerometer 6, see 
Fig. 5.56a, for axial tensile load Fax = —1200N, axially unloaded beam Fax = ON 
and axial compressive load F,x = 1200 N. Thereby, Gy denotes the maximum ampli- 
tude without shunt-damping, ae the maximum amplitude with the RL-shunt and 
Ge the maximum amplitude with the RLC-shunt in Fig.5.57a. Vibration attenu- 
ation is achieved with RL- and RLC-shunts, but is reduced for the uncertain axial 
loads compared to the unloaded beam. However, the attenuation with the RLC- 
shunt is always higher than with the RL-shunt with the maximum amplitude of 
the RL-shunt GRL = 29.26 m/s?/V being higher than the maximum amplitude of 


the RLC-shunt are = 4.68 m/s?/V. Furthermore, the attenuation deviates less for 
the RLC-shunt, suggesting that the RLC-shunt is less sensitive to uncertainty in the 
axial load compared to the RL-shunt [118, 120]. 

Figure 5.57b shows the histogram of the numerically simulated maximum ampli- 
tudes Gy with epistemic uncertainty from the axial load, aleatoric uncertainty from 
the manufacturing and assembly of the piezo-elastic support as well as from the 
variation of shunt components and transducer parameters for RL- and RLC-shunts, 
according to [118]. The 95% quantile of the maximum amplitude Q° and the most 
likely maximum amplitude ` are used to compare the uncertainty in vibration 
attenuation when using the RL- and RLC-shunts. The most likely maximum ampli- 
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Fig. 5.58 Test setup of the two dimensional beam truss structure 


tude Dir, = 26.77 m/s?/V as well as the 95% quantile of the maximum ampli- 
tude OF = 35.81 m/s?/V of the RL-shunt are higher than the RLC-shunt’s most 
likely maximum amplitude } `p; c = 5.42 m/ s*/V and 95% quantile of the maximum 
amplitude Q} = 35.81 m/s?/V. 


Numerical investigation of piezoelectric shunt-damping in a beam truss 
structure 


After the extensive investigation of piezoelectric shunt-damping in a single beam 
test setup subject to data uncertainty, piezoelectric shunt-damping with the piezo- 
elastic support is investigated in the two-dimensional beam truss structure shown in 
Fig. 5.58. It is derived from the upper truss structure of the MAFDS in Sect. 3.6.1. 
The beam truss structure comprises seven beams / to 7 connected to each other via 
five spheres A to E with connector elements. Additional masses m can be attached 
at spheres D and E to introduce epistemic uncertainty in the static load of the beam 
truss structure. This results in a variation of the axial loads of the individual beams 
shifting the structural eigenfrequencies of the two-dimensional beam truss structure, 
see Fig.5.56a. The piezo-elastic support F connects beam 2 with sphere B, where 
an electrodynamic shaker G is attached that dynamically excites the beam truss 
structure. Seven accelerometers are each positioned slightly off-centred at beams / 
to 7 to determine the local lateral vibrational behaviour. 
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Fig. 5.59 Numerically simulated amplitude responses |Gy,| of the two-dimensional beam truss 
structure a shunt and additional mass mọ = 50 kg (——) and with (a) RL-shunt and (b) RLC-shunt 
for various additional masses m_ = Okg (----), mg = 50 kg (——) and m = 100kg (— —) at 
spheres D and E, Fig.5.58 


Here, we numerically investigate the vibration attenuation of the two-dimensional 
beam truss structure with the piezo-elastic support shunted to an RL- and RLC-shunt 
without additional masses m_ = 0 kg as well as with an additional mass mg = 50 kg 
and m = 100kg at each sphere D and E using a finite-element model derived 
in [184]. Figure 5.59 shows the numerically simulated amplitude response |G,,| with 
maximum amplitude Ĝw = 29.06 dB from the excitation with the electrodynamic 
shaker to the accelerometer at beam 2, Fig. 5.58. The RL- and RLC-shunts are tuned to 
the two-dimensional beam truss structure’s first eigenfrequency at additional mass mo 
and used for all three uncertain load cases. Analogous to the single beam test setup, 
the maximum amplitude with RL-shunt GR’ = 19.08 dB is higher than the RLC- 
shunt’s maximum amplitude GRL = 0.81 dB. Furthermore, the vibration attenuation 
with the RLC-shunt is less sensitive to the uncertain loads than with the RL-shunt. 


Conclusion 


In this section, we presented piezoelectric shunt-dampings with the piezo-elastic 
support as a possible (semi-)active process manipulation for vibration attenuation in 
the single beam shown in Fig. 5.56a, if non-stochastic and stochastic data uncertainty 
are present [118]. For a two-dimensional beam truss structure, numerical investiga- 
tions show a successful vibration attenuation with piezoelectric shunt-damping, if 
data uncertainty is present. In general, we are able to demonstrate that a higher and 
less sensitive vibration attenuation of a single beam and a beam truss structure are 
achieved with the RLC-shunt in comparison to the RL-shunt. The numerical results 
for the beam truss structure will be experimentally validated in the future at the 
test setup of the two-dimensional beam truss structure, see Fig.5.58. Furthermore, 
piezoelectric shunt-damping will be further investigated in the complex structural 
dynamic system of the MAFDS, Sect. 3.6.1. 
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5.4.7 Active Buckling Control of Compressively Loaded 
Beam-Columns and Trusses 


Maximilian Schaeffner, Roland Platz, and Tobias Melz 


Lightweight mechanical truss structures that comprise slender beam-columns and 
stiff nodes are commonly used in mechanical engineering applications to distribute 
both (quasi-)static and dynamic loads within the usage phase, see Sect.3.1, e.g. 
in aircraft landing gears or vehicle suspension struts [280]. However, the slender 
beam-columns are sensitive to failure by buckling when loaded by compressive axial 
loads F, and their maximum bearable axial loads Fy max are considerably reduced 
by data uncertainty in the material, geometry, loading or support properties [262], 
see Sect. 2.1. In order to increase the maximum bearable axial load, active buckling 
control of rather academic beam-column systems with rectangular cross-sections has 
been investigated numerically and experimentally [25, 93, 94, 196, 261, 275, 286]. 
In contrast, we apply active buckling control to a practical beam-column system with 
a circular cross-section in order to demonstrate the mastering of uncertainty in beam- 
column buckling by active process manipulation, which was motivated in Sect. 3.2 
and Sect.3.4. The beam-column system is later integrated into the Modular Active 
Spring-Damper System (MAFDS) presented in Sect.3.6.1. In the following, first 
the concept of active buckling control and the application to a single beam-column 
system is presented. Then, the application to a three-dimensional tetrahedron truss 
structure is discussed. 


Active buckling control in a single beam-column system 


The concept of active buckling control was experimentally investigated first for the 
single beam-column system shown in Fig. 5.60a [235, 236]. The beam-column used 
for active buckling control is a slender beam-column with length I, = 400 mm and 
a circular solid cross-section with constant radius r, = 4mm. It is made from high- 
strength aluminium alloy EN AW-7075 with Young’s modulus Ey, = 71 GPa and 
density 0, = 2850 kg/m? to avoid plastic deformation due to beam-column buckling 
[262]. Four strain gauge sensors in the beam-column centre are used to measure the 
surface strains due to bending to calculate the deflection of the beam-column in the 
local y- and z-directions. 

The lower and upper beam-column ends are connected to piezo-elastic supports 
with integrated piezoelectric stack actuators depicted in Fig.5.60b; these are fixed 
to a baseplate and a parallel guidance to allow the introduction of compressive axial 
loads F,, respectively. The novel concept of the piezo-elastic support was patented in 
[91] and, other than for active buckling control, is also used for vibration attenuation 
with shunted piezoelectric transducers, as discussed in Sect.5.4.6 and [118, 120]. 
The piezo-elastic supports provide elastic boundary conditions for the beam-column 
and include the piezoelectric stack actuators, which are mechanically prestressed by 
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Fig. 5.60 a Single beam-column system for active buckling control, b sectional view of piezo- 
elastic support with local x-, y- and z-directions [235] 


allocated helical disk springs. The piezoelectric stack actuators are integrated in the 
lateral load path via axial extensions at a distance lext from the beam-column ends 
and exert active lateral forces in the local y- and z-directions, so that they may influ- 
ence the lateral beam-column deflections. The central element of the piezo-elastic 
supports are two differently shaped membrane spring elements that are manufactured 
by a single point incremental forming process with the 3D Servo Press presented in 
Sects. 3.6.3 and 5.4.1 and [155]. The membrane spring elements bear the axial and 
lateral loads and allow rotations in any plane perpendicular to the beam-column’s 
local x-axis. 

The piezo-elastic supports with integrated piezoelectric stack actuators stabilise 
the beam-column in arbitrary lateral direction by active bending moments at each 
end of the beam-column. A linear parameter-varying (LPV) controller, in particular 
a gain-scheduled Hæ controller, which guarantees stability and performance for 
arbitrary trajectories of dynamic axial loads F, (t), is used for the active buckling 
control. For controller design, the beam-column including the piezo-elastic supports 
is modelled by an axial load-dependent finite element (FE) model for the FE degrees 
of freedom r(t) with equation of motion and output equation 


M(t) + Di(t) + K(F)) r@) = Bult) (5.26) 
y(t) = Cr(t) (5.27) 


where M is the mass matrix, D is the damping matrix, K (F, t (t)) is the axial load- 
dependent stiffness matrix, B is the voltage input matrix and C is the output matrix. 
The actuator voltages of the piezoelectric stack actuators V,, and the beam-column 
bending strains £; are combined in the beam-column input and output vectors 
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Fig.5.61 Passive (——) and active (— ) beam-column systems with quasi-static axial load F, (t), 
a absolute modal displacement qı versus axial load F, with maximum admissible displace- 
ment g1,max (— —), b normalised histograms and fitted three-parameter WEIBULL distributions 


Pw(Fx max) of maximum bearable axial loads Fy, max with most likely value Yr, max and interper- 
centile range Rr, [235] 


x,max 


— | Vez y) _ [£s y(t) 
ahap] and wai (5.28) 


After Laplace transformation, the 2 x 2 matrix of transfer functions 
G(F,, s) = —— (5.29) 
u 


describes the transfer behaviour from the actuator voltages u to the beam-column 
strains y (5.28) [249]. 

The most sensitive parameters of the axial load-dependent FE model (5.26) and 
(5.27) of the beam-column system, which is augmented by the dynamic transfer 
behaviour of electrical components used for signal conditioning, are calibrated with 
experimental data and then used to design the LPV controller. Subsequently, the pas- 
sive (without controller) and active (with controller) beam-column systems are loaded 
by quasi-static and dynamic axial loads F,(t) and the absolute lateral modal dis- 
placement qj (t) is measured. Figure 5.61a shows the experimental load-displacement 
curves of passive buckling and active buckling control for the single beam-column 
system in Fig.5.60a subjected to a slowly increasing quasi-static axial load F, (t). 
We conducted the experiments with a representative sample of 30 nominally iden- 
tical passive and active beam-column systems in order to quantify stochastic data 
uncertainty in the maximum bearable axial loads according to the classification of 
uncertainty presented in Chap. 2. 

Normalised histograms and three-parameter WEIBULL distribution fits pw (F\., max) 
for the maximum bearable loads Fy max of the passive and active beam-column sys- 
tems are shown in Fig.5.61b. For the active beam-column system, the most likely 
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Fig. 5.62 Experimental tetrahedron truss structure, a CAD sketch of test setup with global x’-, y’- 
and z’-directions, b photo of test setup 


maximum bearable axial load X p, „a increases by 29% and the variability expressed 
by the interpercentile range RF, mx reduces by 70% in comparison to the passive 
beam-column system. Thus, stochastic uncertainty in the maximum bearable axial 
loads is mastered by active process manipulation using active buckling control for 


the single beam-column system. 


Active buckling control in a tetrahedron truss structure 


As an intermediate step to the integration of active buckling control in the MAFDS, 
which represents a realistic load-bearing structure, Sect. 3.6.1, we investigate active 
buckling control in an experimental three-dimensional tetrahedron truss structure. 
Figure 5.62 shows the experimental tetrahedron truss structure that comprises three 
beam-columns b/-b3 with piezo-elastic supports, in the following called active 
beam-columns, and three passive beams b4—b6. They are connected to each other via 
the spheres S/—S4, where the spheres S/—S3 are clamped and sphere S4 is free and 
may be used to introduce vertical compressive loads Fy into the tetrahedron truss 
structure in global z’-direction. 

The lateral dynamic behaviour of the three active beam-columns, which is essen- 
tial for the model-based controller synthesis for active buckling control, was investi- 
gated in [237]. Here, we used the experimental beam-column transfer functions (5.29) 
of the unloaded active beam-columns b/—b3 in the tetrahedron truss structure in 
Fig. 5.62 to calibrate the FE model of the single beam-column (5.26) and (5.27). The 
lateral dynamic behaviour of all active beam-columns b/—b3 are very similar and 
their boundary conditions in the tetrahedron truss structure are adequately described 
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by the numerical beam-column transfer function (5.29) originating from the single 
beam-column test setup in Fig.5.60a. Thus, no additional model of the tetrahedron 
truss structure is necessary and the calibrated FE beam-column models will be used 
for the model-based controller synthesis as well as active buckling control of the 
tetrahedron truss structure in future investigations. 

In conclusion, active buckling control may be used to master uncertainty in the 
maximum bearable load of mechanical load-bearing structures prone to buckling. 
The effectiveness of this form of active process manipulation was shown for a single 
beam-column system subject to quasi-static and dynamic axial loads. Furthermore, 
it is currently tested for a tetrahedron truss structure and prepared for the integration 
in the MAFDS. 


5.4.8 Load Redistribution Via Semi-active Guidance 
Elements in a Kinematic Structure 


Christopher M. Gehb, Roland Platz, and Tobias Melz 


In many mechanical engineering applications, withstanding external loads is one of 
the key tasks within the usage phase, see Sect. 3.1. In most cases, the load is transmit- 
ted from one or more points of load application via a predetermined load path to the 
structural supports. Additionally, defined kinematics are often an important part of 
the functional performance in a load-bearing structure to enable a specified relative 
displacement of structural components. An example is the compression stroke of a 
landing gear or a suspension strut in airplanes or vehicles. A spring-damper often 
determines the main kinetic properties [183]. The compression stroke, in turn, is 
enabled by guidance elements, such as torque-links or other suspension links [65, 
152]. In general, the guidance elements kinematically connect two or more parts of 
a load-bearing structure in order to achieve defined relative displacements. In most 
cases, the load path going through the load-bearing structure is predetermined in 
the design phase and, mostly, is not subject to any changes during the structure’s 
lifetime [218]. However, if parts of the load-bearing structure become weak or suffer 
damage, e.g. due to deterioration or overload, the load capacity may become lower 
than designed leading to uncertainty [112]. In this case, semi-active process manip- 
ulation, as introduced in Sects. 3.2 and 3.4, in form of load redistribution can be an 
option to master this uncertainty by adjusting the load path and, thus, reducing the 
effects of damage or prevent further damage, compare Sect.3.6.1. Also, a desired 
support reaction force ratio achieved by load redistribution during operation might be 
useful if the predetermined load path is not suitable anymore [115]. In the following, 
first the concept of load redistribution and the investigated test setup are presented. 
Then, semi-active guidance elements for load redistribution are introduced. Finally, 
numerical and experimental results are discussed. 
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Fig. 5.63 Semi-active load redistribution test setup with original and additional load path via the 
right semi-active guidance element [113] 


Concept of load redistribution 


Figure 5.63 depicts a schematic representation of an exemplary load-bearing struc- 
ture to demonstrate load redistribution, compare Sect. 4.1.2. It represents a simplified 
surrogate version of the MAFDS, Sect. 3.6.1. A spring-damper and two semi-active 
guidance elements connect a mass and a beam forming a load-bearing structure. 
The beam distributes the load to two supports at its ends. Varying support stiff- 
ness simulates varying load capacity in an academic and reproducible way and is 
a manifestation of data uncertainty, see Sect.2.1. Load redistribution according to 
[114, 115] entails the redistribution of loads between the left and right support in 
case of present or anticipated damage. The loads previously passed through the 
spring-damper solely (grey line in Fig.5.63) are partly redistributed via the con- 
trolled semi-active guidance elements. If, for example, the left support is assumed 
to be damaged or weak, it can be relieved via the right semi-active guidance element 
providing a load path in addition to the spring-damper. Hence, parts of the loading 
are bypassed through the right semi-active guidance element towards the undamaged 
right support. The additional load path is depicted in Fig. 5.63 by a dashed black line 
passing through the right semi-active guidance element compared to a thin black 
line indicating the corresponding weaker load path through the spring-damper. Load 
redistribution during operation can be attributed as semi-active process manipulation 
and is part of Structural Health Control SHC [194]. SHC combines structural health 
monitoring, assessing the structural health condition, e.g. the load-bearing capacity, 
and an adequate semi-active or active process manipulation in order to load or unload 
load-bearing components, compare Sect. 3.4. 
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Fig. 5.64 Semi-active guidance element, a realisation and b CAD illustration according to [113] 


Semi-active guidance elements 


Figure 5.64a depicts a close-up view of the right semi-active guidance element 
mounted to the test setup, compare Sect. 4.1.2. The already existing components of 
the load-bearing structure, i.e. the guidance elements, are augmented with electro- 
magnetic friction brakes for semi-active process manipulation to adapt the structure’s 
load path via an induced friction moment. Figure 5.64b depicts a CAD illustration 
of the semi-active guidance element. It consists of two kinematic links connected 
by a middle joint, which is equipped with an electromagnetic friction brake. Within 
the friction brake, the electromagnetically induced normal force F, acts on the fric- 
tion lining in negative x-direction and is controlled via a controlled input voltage 
applied to the brake’s electromagnet. The normal force F}, in turn, causes a friction 
moment Mr and changes the load transmitting properties of the semi-active guid- 
ance element by increasing or decreasing the possible amount of the loading passing 
through the joint. The mathematical relation between the electromagnetic normal 
force F, and the related friction moment Mç is presented in [112, 113] applying the 
LUGRE friction model. 


Numerical and experimental results of load redistribution 


The uncertainty within the load path, assumed to be a support with reduced stiffness, is 
supposed to be mastered by means of semi-active load redistribution. The supports’ 
stiffness is adjustable for the experiments in order to introduce uncertainty in a 
repeatable and measurable way. Thereby, we can numerically and experimentally 
investigate and evaluate the load redistribution capability within the exemplary load- 
bearing structure from Sect.4.1.2. The stiffness reduction, which is achieved via 
the adjustable supports in Fig.5.63 according to [144], causes uncertain dynamic 
behaviour and uncertain load capacity. In our example, this is misalignment of the 
beam and undesired support reaction force ratio among the two supports, for details 
see [112]. Here, we exemplarily present the resulting load path when trying to reduce 
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the undesired misalignment caused by a damaged support with reduced stiffness. The 
load path is evaluated by means of the left and right support reaction forces Fy, and 
Fr. A comprehensive case study comprising different control strategies and different 
levels of damage is presented in [112]. 

Figure 5.65 depicts the simulated and measured load path of the load-bearing 
structure due to an external force excitation by the dropped load mass resulting 
in a step load applied to the mass, compare Fig.5.63. A time series of two sec- 
onds is simulated and measured to analyse the load path and load redistribution 
capability with and without semi-active control. For the numerical results, we con- 
sider the remaining model prediction uncertainty by conducting Monte Carlo (MC) 
simulations with the calibrated parameter ranges, compare Sect.4.1.2. Instead of 
ignoring the uncertainty by stating only one deterministic curve, the uncertainty in 
the model prediction caused by the remaining parameter uncertainty is indicated by 
shaded areas in Fig. 5.65. Solid lines represent the measured load paths, averaged for 
10 measurements [112]. 

For the experimental results in Fig. 5.65, the excitation load is equally distributed 
to both supports in case of no semi-active load redistribution. This leads to almost 
identical measured support reaction forces. In case of a support with reduced stiffness 
and, hence, load-bearing capacity, the load redistribution results from the semi-active 
guidance elements. The excitation load is no longer equally distributed to the sup- 
ports, but depends on the support stiffness. The steady state load reduction of the 
assumed to be damaged right support is about 24%. The shaded area of the MC sim- 
ulation results show similar dynamic behaviour for the entire time scale. Thus, the 
numerical results widely encompass the experimental results for both support reac- 
tion forces with and without semi-active load redistribution. The measured steady 
state left and right support reaction forces FL and Fr are within the range of the 
model predictions. Taking into account the overall time scale, the load paths and 
the load redistribution capability is predicted sufficiently accurate using the cali- 
brated parameter ranges from Sect.4.1.2 and considering the remaining parameter 
uncertainty. 

The load is partly redistributed towards the undamaged support and the damaged 
support is relieved. Since we cannot redistribute loads unlimitedly, there remains 
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a steady state control deviation for the numerical and experimental results. This is 
most probably bot not exclusively due to the limitations of the semi-active approach, 
which cannot introduce energy into the structure via the electromagnetic friction 
brakes to completely eliminate the control deviation, compare Sect.3.4. Overall, a 
successful semi-active process manipulation with significant load redistribution is 
numerically and experimentally proved [112, 114, 115]. 

For a more practical application of load redistribution, the concept of semi-active 
guidance elements as shown in Fig.5.64 is transferred into up-scaled semi-active 
guidance elements for the MAFDS in future work, see Sect. 3.6.1. Thus, the planar 
load redistribution problem transforms into a spatial load redistribution problem. The 
load path of the MAFDS will become adaptable in order to master uncertainty in the 
spatial structure application. 
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Abstract This chapter describes three general strategies to master uncertainty in 
technical systems: robustness, flexibility and resilience. It builds on the previous 
chapters about methods to analyse and identify uncertainty and may rely on the avail- 
ability of technologies for particular systems, such as active components. Robustness 
aims for the design of technical systems that are insensitive to anticipated uncertain- 
ties. Flexibility increases the ability of a system to work under different situations. 
Resilience extends this characteristic by requiring a given minimal functional per- 
formance, even after disturbances or failure of system components, and it may incor- 
porate recovery. The three strategies are described and discussed in turn. Moreover, 
they are demonstrated on specific technical systems. 


In this chapter, we eventually come to the final key topic of this book, namely 
strategies to master uncertainty in technical systems. The underlying concepts and 
ideas of this chapter have already been introduced in Sect. 3.5. 
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It is useful to recall that several prior steps are necessary to master uncertainty. 
This is illustrated in Fig. 1.12, where the methods of this chapter are addressed on 
the top layer, with the layers below corresponding to the preceding chapters. In the 
first step, one needs to be aware of the existence of uncertainty and the different 
types of uncertainty as described in Chap. 2. The next step is to analyse, quantify and 
evaluate uncertainty as presented in Chap. 4. After the identification of uncertainty 
in a particular system, the legal requirements are determined (Sect. 5.1), before the 
technological options have to be reviewed, created and evaluated. In Chap. 5 tech- 
nologies and methods with focus on product design and process chains are introduced 
(Sect. 5.3). Moreover, it might be possible to use (semi-)active components to master 
uncertainty in the system (Sect. 5.4). 

The first strategy to master uncertainty described in the following is robustness, 
see Sect.6.1. The goal is to design a robust system that not only fulfils its function 
at the design point, but also in the surrounding neighbourhood, see Sect. 3.5. This 
is achieved by anticipating uncertainty in the design phase, following robust design 
principles or by applying robust optimisation. These general methods are described 
and illustrated on several technical systems and processes, such as presses, as well 
as tapping and reaming, see Sects. 6.1.7 and 6.1.8, respectively. The description of 
such applications highlights the fact that the general approach needs to be adapted 
to the particular circumstances. 

The second strategy is flexibility, see Sect. 6.2. The objective is to design flexible 
systems that can react to uncertain conditions during the usage phase. Hence, even 
unpredicted disturbances might be mastered. 

The third strategy is resilience, see Sect. 6.3. Here a technical system is designed in 
such a way that it fulfils a given predetermined minimal functional performance, even 
when disturbances and failures of system components occur and may include recov- 
ery, see the definition introduced in Sect. 3.5. As motivated in the latter section, both 
flexibility and resilience try to handle ignorance (see Chap. 2). This topic is depicted 
and detailed in Sect. 6.3, including several measures for resilience and demonstrating 
the practical application in systems, such as truss topologies (Sect. 6.3.4) and fluid 
systems (Sect. 6.3.8). 

Many of the sections in this chapter combine knowledge from mechanical engi- 
neering and mathematics, e.g. by combining technological and domain knowledge 
with mathematical optimisation. Moreover, the presented strategies to master uncer- 
tainty of this chapter connect the different product life phases from system design 
to usage, see Fig. 3.1. Overall, this chapter provides a broad discussion of general 
strategies to master uncertainty, including a discussion of specific technical sys- 
tems. 
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6.1 Robustness 


Hermann Kloberdanz, Alexander Matei, Marc E. Pfetsch, Andreas Schmitt, 
Johann M. Schmitt, and Stefan Ulbrich 


In all life cycle processes, robust systems prove to be insensitive or only insignifi- 
cantly sensitive to deviations in system properties or varying usage. In this section, 
we consider robustness as a strategy to master uncertainty from the different per- 
spectives of mathematical optimisation, product or system design and produc- 
tion. 

As an example, to further illustrate our understanding of robustness as introduced 
in Sect. 3.5, we first examine how robustness is incorporated in mathematical opti- 
misation, before we give a short overview of the Sects. 6.1.1-6.1.8. 

Robust optimisation is a mathematical approach that seeks solutions with guar- 
anteed worst-case behaviour, provided that the uncertain data comes from a known 
uncertainty set U. Let an optimisation program be described in the form 


min f(x, p) st. f[@,p)<0, forie J, (6.1) 


where x is the optimisation (or design) variable, p is a vector of uncertain parameters, 
f° is the scalar objective function, and f’, i € J, are finitely many scalar constraint 
functions. Provided that p € U is known and fixed, the Problem (6.1) reduces to a 
classic optimisation program. In practice, however, this assumption does not hold. 
The parameters p are not exactly known, but we assume that they are contained in 
the given uncertainty set U. 

The robust approach eliminates the unknown p from Problem (6.1) by using a 
pessimistic assumption on the objective function and by requiring the constraints to 
hold regardless of the value of p, i.e. for its worst-case realisation, which leads to 


min max f(x, p) st fi(x,p) <0, foriel, forp eu. 
x pe 


Due to its bilevel (min-max) structure, this problem is difficult to solve in this gen- 
eral setting. In the following subsections, we therefore present different solution 
strategies which exploit the specific problem structure, such as the fÍ being lin- 
ear or nonlinear, time-variant or time-invariant, and also the analytic structure of 
U. The latter could be in ellipsoidal form or consist of finitely many elements, for 
example. 

In more detail, we exemplify robust optimisation techniques, models and appli- 
cations in the first four sections. In Sect. 6.1.1 we introduce a robust truss topology 
optimisation framework in which we particularly consider dynamic models, beam 
elements and discrete decision variables. Furthermore, in Sect. 6.1.2 the employment 
of active elements is discussed for static and dynamic bar models, and demonstrated at 
the examples of active buckling control and shunt damping. In Sect. 6.1.3, we present 
robust optimisation techniques for problems involving partial differential equations 
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and apply these techniques to the optimal design of a truss structure under uncertain 
dynamic load as well as the optimal design of a sensor element. Sect. 6.1.4 is con- 
cerned with quantified programs, which extend the robust optimisation approach to 
more than two stages. 

In the subsequent sections, we move away from the mathematical point of view 
to investigate design principles and present control strategies to achieve robustness 
in a technical system. Sects. 6.1.5 and 6.1.6 describe possibilities of robust design of 
mechatronic systems. First, the mastering of disturbing influences in the early phases 
of the design process by process model-based analysis and synthesis strategies is 
presented. The process-oriented robust design then focuses mainly on the design of 
the mechanical components in the force flow. The design for clarity is recognised as 
particularly effective in robust design. 

If measures regarding the mechanical system are limited, the control of the sys- 
tem offers additional possibilities to master uncertainty during the production phase. 
Potentials and effectiveness of nonlinear robust closed-loop control systems are 
shown in Sect. 6.1.7. 

In Sect. 6.1.8, the robust design of process chains is explained using the linked pro- 
duction processes of drilling and reaming as well as drilling and tapping. The robust- 
ness of process chains is achieved by tool design, by optimising process parameters, 
and by additional adaptation process steps. 


6.1.1 Robust Topology Optimisation of Truss Structures 


Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Alexander Matei, 
Marc E. Pfetsch, Johann M. Schmitt, and Stefan Ulbrich 


The goal of truss topology design is to determine truss structures that are both, stable 
and lightweight. Stability here means that data uncertainty in the form of incertitude 
in the inputs, cf. Sect. 2.1, is taken into account by a robust approach in the system 
design phase, see Sect. 3.5. In the following, we concentrate on a particular approach 
via a semidefinite program (SDP), which was originally introduced by Ben-Tal and 
Nemirovski [17]. Exemplary alternatives to our treatment of uncertainty in truss 
topology design are described in [81, 101, 176]. For an overview of non-robust 
topology optimisation we refer to [18]. The approach, as presented here and in [111], 
is unique in the sense that dynamic uncertainty is mastered in robust truss topology 
design with SDP. Furthermore, another extension is the usage of binary variables for 
trusses introduced by Mars [122]. 

We first introduce the basic model and the corresponding optimisation problem for 
truss topology design. Then, we discuss the concept of robust optimisation as adopted 
in Sect.6.1 with regard to this model. In the following paragraphs, we extend the 
basic optimisation problem to beam elements and dynamic truss models for vibration 
attenuation following [75, 111]. Finally, all these different models are compared 
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using the example of the upper truss of the Modular Active Spring-Damper System, 
see Sect. 3.6.1. 


Basic model 


In this paragraph, we present the basic model of a truss which uses a so-called ground 
structure, i.e. a simple directed graph D = (V, E) with n nodes V = {v1,..., Ug} < 
R’. The edges E represent possible bars. A subset Vs C V of size n of the nodes 
is freely movable, while the remaining ones are fixed. At each of the n p free nodes 
d-dimensional forces are applied, which are contained in the vector f € R“ with 
ds =d - np. These forces cause displacements u € IR“, which are determined by 
the equilibrium constraint A(x) u = f, where x € RE represents the cross-sectional 
areas of the possible bars in €. Here, A(x) = ye g Ae Xe is the stiffness matrix with 
A. = b,b], where b, = (be(V) vev, € R“ and 


e~e? 


vi—Uj . 
VE ——,, ifv=u;, 


lui —vy ll 


b.(v) = VE» ifv = vj, for e = (vi, vj), v € Vp, 
32 


llv; — 


0 otherwise, 


where E is Young’s modulus of the used material. One possible aim is to find the 
stiffest truss under the restriction of a total volume bound Vmax € R+. We measure 
the stiffness of the structure by the compliance c = i fu, which represents the 
potential energy stored in the deformed truss and has to be minimised to maximise 
stiffness. This yields the optimisation problem 


min 4fTu st. A(x)u=f, YO lexe < Vmax, x >O, (6.2) 


RE 
i eeE 


where /, denotes the length of the edge e € E. This optimisation problem can be 
reformulated as a semidefinite program (SDP) 


min T st. @ HE X lx < V, x>0 (6.3) 
reR, xeRE f A(x) = ’ eve — max» = c} 


ecE 


cf. [17]. Here, a symmetric, positive semidefinite matrix M is denoted by M > 0. 
Analogously, we can also minimise the volume of the truss for a given upper bound 
on the compliance Cmax which leads to a similar optimisation problem (6.3). 
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Robustness 


In mechanical structures, uncertainty often appears in the form of parameters that 
are not exactly known, e.g. loads acting on a truss. One main topic of this section 
is the modelling and the mathematical treatment of data uncertainty, see Sect. 2.1. 
In the context of truss topology optimisation, even small changes of the considered 
load scenario may lead to severe instabilities. In order to cope with this problem, 
we use robust optimisation, see Sect. 6.1, where we consider uncertainty sets instead 
of fixed parameters. We consider the given force f to be uncertain. Then the robust 
optimisation problem corresponding to Problem (6.2) consists of finding a vector 
xE RZ to such an extent that the compliance is minimal under the worst-case load 
scenario, i.e. 

min max fr st A@u= f, >) lexe Yon X20, 64) 

ecE 

where U/ denotes an uncertain set of forces f. Note that (6.4) is of the same form as the 
robust formulation in Sect. 6.1 and can be reformulated as an SDP via the techniques 
of Ben-Tal and Nemirovski [17]. This SDP can be solved efficiently. Therefore, it 
is desirable to reformulate these robust problems as SDPs. Nevertheless, the results 
of Ben-Tal and Nemirovski [17] strongly rely on the special structure of the inner 
maximisation problem. For dynamic problems, which are also addressed in this 
section, these techniques cannot be applied, since we have to deal with ordinary 
differential equations as constraints. However, using the Bounded Real Lemma we 
can still reformulate the robust problem as an SDP. 

There are different ways to choose the uncertainty set of forces U. One could for 
example consider polyhedral uncertainty sets U which are given by the convex hull of 
s € IN many forces fi, ..., fs. These can be integrated into the problem by adding an 
additional SDP constraint for each force. A second possibility is to work with ellip- 
soidal uncertainty sets, where U = {f = Qa: a'a < 1} for some scaling matrix 
Q e R“r*dr. A common choice for Q is given by Q = [fiz s<; fs, Oe1,.--, Pen, | 
with a scaling factor 6 > 0 and ny = dy — s. The scenario set F = { fi, ..., fs} 
describes the “most important loads” and {6e1,..., Oen} the “occasional loads”. 
Here, {eı,...,e„,} is chosen as an orthonormal basis of the orthogonal complement 
to L(F) in R”, where L(F) C R? denotes the linear span of F, see [17]. In case of 
ellipsoidal uncertainty sets, a major result of [17] is that (6.4) is equivalent to 


: 271 Q' 
min s.t. > 0, leXe < V maxs > 0. 6.5 
BE 2. x ma 


In practice, often only a finite set A of cross-sectional areas is available. Then, we 
introduce binary variables x$, which have value 1 if and only if the cross-sectional 
area of bar e € E is equal toa € A. Integrating these binary decisions in our model, 
we obtain a mixed-integer SDP (MISDP) formulation 
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. 271 Ot : 
min 7 s.t. ( Q nn) >0, D D alex? < Vmax, D xé <1, foree E 
xe{0,1}E*4 ecE acA acA 


as independently shown in [106, 122]. 


Beam elements 


The Truss Topology Design Problem (6.5) uses an idealised model of pin-connected 
bars. This can be extended to beam elements which can also represent bending. The 
new stiffness matrix, which depends nonlinearly on x, can be computed by using a 
finite element approach and inserted into (6.5), see [63]. The obtained non-convex 
SDP can be solved by a sequential SDP method based on [37], in which the nonlinear 
SDP constraint is linearised and iteratively solved by applying a suitable step length 
rule. In addition to rigid connections, one can also model pin-connected beams by 
introducing binary variables, which are coupled via linear constraints and indicate 
the connection type. In this approach, the stiffness matrix has to be further modified 
and the resulting nonlinear mixed-integer SDP can be solved as in [75] by using 
a sequential SDP method which is embedded in a Branch-and-Bound algorithm 
solving a non-convex SDP in each node. 


Solving mixed-integer semidefinite programs 


As described before, solving the problems arising from robust optimisation models, 
possibly incorporating integer decisions like a discrete choice of truss thicknesses 
or placing actuators (see Sect. 6.1.2), results in mixed-integer SDPs. For this class 
of problems, only very few software packages are available. Therefore, SCIP-SDP, 
a software system based on the framework SCIP [67] was created, which is pub- 
licly available [147]. SCIP-SDP contains interfaces to several SDP-solvers, such as 
Mosek, DSDP and SDPA. Moreover, it contains a variety of presolving techniques, 
branching rules and primal heuristics. The paper [65] describes some of the used 
techniques and provides an analysis of the preservation of strong duality when work- 
ing in a branch-and-cut framework. More details are given in [62, 122, 123]. A 
parallel version of SCIP-SDP is also available, see [149]. 


Dynamic model 


As an extension to the static approach above, we consider a dynamic truss model 
which can be used for example to describe and reduce structural vibrations in mechan- 
ical systems resulting from time-dependent uncertain loads f : R} — R“. Within 
the dynamic model, the displacements u(t) are given by the solution of the ordinary 
differential equation system 
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M(x) ii(t) + D(x) a(t) + A(x) u(t) = f(D, t>0, 


u(0) =0, ù(0) = 0, (6.6) 


where M(x) € R“s*dr, D(x) € R“r*dr and K (x) € R“r*dr denote the mass matrix, 
the damping matrix and the stiffness matrix, respectively. We use the mean squared 
displacement 


CO 
7) = f MOBA = Mall; ner, 
| a: 


as a measure of stability and stiffness. The time-dependent load f € U is again 
uncertain. Here, the uncertainty set is of ellipsoidal form 


U ={f = Qa: lialz, < 1} 


where Q is chosen as explained before. Then the robust dynamic truss topology 
design problem reads 


min max J(u) s.t. u solves (6.6), Xo lexe SVa KU. (6.7) 
xeRE feu GER 


Rewriting (6.6) as a system of first order differential equations 


yt) = P@) yO) + Bx) Galt), ut) = Lyt), 1>0, 


u(0) = 0, u(0) = 0, (6.8) 


and using the Bounded Real Lemma, see [11], we can reformulate the optimisation 
problem (6.7) as 


i 2 
min Yterliflle 
xeRE yeR,,YeR'r“r 


P(x) Y +YP(x) YB@)O L' 


s.t. O'B(x)'Y -yl 0 | XO, (6.9) 
L 0 yI 
-Y<0, X lexe < Vmax, x>0, 
ecE 
where a penalisation term ey || Y Iž is added to the cost function, see [111]. Here, || - ||p 


denotes the Frobenius norm and ey is some positive constant. In [111], the optimi- 
sation problem (6.9) is solved by using a sequential SDP algorithm, see also [113]. 
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Comparison of the models 


In the following, we compare the models from this section using the example of 
the upper truss of the Modular Active Spring-Damper System, see Sect. 3.6.1 and 
Fig. 6.1a, where one possibly uncertain force is acting on the centre node. In Table 6.1, 
the cost function values for the solutions of the optimisation problems introduced in 
the subsections above are evaluated for the nominal case, i.e. one fixed force f is 
considered, and for the worst case scenario, where the acting force is uncertain. More- 
over, we compare the corresponding solving times in the last column of Table 6.1. 
As we can see, in the non-robust static case (b) the compliance for the nominal force 
is quite small, whereas in the worst-case scenario it is much larger. This shows that 
the truss becomes unstable, if the force acting on the truss changes. In contrast to this 
behaviour, the values of the cost function in the nominal case and in the worst-case 
almost coincide for the robust problems, where the compliances in the robust static 
case with (d) and without discrete cross-sectional areas (c) are only slightly larger 
than in the non-robust static case. Nevertheless, we note that restricting the available 
cross-sectional areas to a discrete set or considering the dynamic model (f) leads to 
longer solving times. 


(d) (e) (f) 


Fig. 6.1 Results of different optimisation models for the upper truss of the Modular Active Spring- 
Damper System: a basic truss structure, b non-robust static model, ¢ robust static model, d discrete 
cross-sectional areas, e robust static model with beam elements and f robust dynamical truss. Varying 
truss thicknesses are recognisable upon close inspection; see also Table 6.1 for the differences in 
performance 
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Table 6.1 Comparison of solution characteristics for the different models 


Problem Nominal Worst-case Time in s 
Non-robust static (b) 0.1124 4.328 - 10° 0.64 
Robust static (c) 0.1162 0.1181 0.98 
Robust static with 0.1260 0.1275 74.77 
discrete 


cross-sectional 
surfaces (d) 


Robust static with 5.6624 5.8609 8.18 
beam elements (e) 
Robust dynamic (f) 65.0858 66.0157 2199.01 


Conclusion 


In this section, we discussed robust truss topology design via an SDP-approach. We 
introduced a basic truss model and reformulated the minimum compliance problem 
for the robust case as a (mixed-integer) SDP. Furthermore, we compared static and 
dynamic models regarding the worst-case behaviour of the solution to the respective 
optimisation problem. 

In Sect. 6.1.2, we are including active elements into the truss structure, where the 
corresponding robust optimisation problem is stillan SDP. Unfortunately, when deal- 
ing with PDE this is no longer possible, such that fundamentally different approaches 
are necessary, see Sect. 6.1.3. 


6.1.2 Optimal Actuator Design and Placement 


Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Marc E. Pfetsch, 
Andreas Schmitt, Johann M. Schmitt, and Stefan Ulbrich 


The usage of active elements, e.g. actuators, in order to master uncertainty is one 
topical focus of this book, see e.g. Sects. 3.4 and 5.4. As an extension to the example 
of robust truss design in Sect.6.1.1, we integrate abstract actuators inspired by the 
technologies introduced in Sects. 5.4.6 and 5.4.7. The resulting active truss structures 
can employ additional forces f“ in each of the different load scenarios. These forces 
form an additional design parameter, besides the cross-sectional areas of the bars. 
Thus, the robustness of the mechanical structure with respect to uncertain input data, 
e.g. the loads acting on the truss, can be further improved by the optimal design and 
placement of actuators. In Sect.6.1.1 the robust optimisation approach as introduced 
in Sect. 6.1 is used to obtain robust truss topology designs. The incorporation of actu- 
ators into the model leads to more complex formulations compared to Sect. 6.1.1, 
e.g. certain actuators increase the number of stages in the robust optimisation prob- 


6 Strategies for Mastering Uncertainty 375 


lem. Nevertheless, we show that these can be reformulated as semidefinite programs 
(SDP). The objectives of this section are to integrate actuators into the truss topol- 
ogy models introduced in Sect.6.1.1 and to reformulate the corresponding robust 
optimisation problems as SDPs to make these accessible to optimisation methods. 

For this purpose, we present four models for the optimal design of active trusses, 
i.e. trusses incorporating active elements, such as actuators under uncertain loads. 
In the first model, the actuators generate a counterforce f° € F** acting on each 
free node of the truss for each load scenario. Here, the set F** depends on the 
choice of the bars equipped with actuators. We call bars with integrated actuators 
active and those without actuators passive. This approach is considered in the para- 
graph below, see also [75]. Another possibility is the operation of the actuators via 
a parameterised algorithm, for example feedback controllers, where the parameters 
are considered as optimisation variables. This second model is examined in the next 
paragraph, cf. [111]. In the third model, we apply actuators with the aim to achieve 
an improvement of the buckling resistance of trusses, which is based on [64]. In the 
last paragraph, we introduce the fourth model, namely the optimal design of shunt 
damping for vibration attenuation as presented in [112]. 

Another approach for truss topology design with active elements was made 
by [116] using genetic algorithms but neglecting uncertainty. Further methods for the 
reduction of vibrations in mechanical systems by actuator placement can be found 
in [86, 140]. Buckling control has also been addressed by [16, 34, 139]. 


Robust optimisation of active trusses via mixed-integer semidefinite 
programming 


In the following, we extend the robust static truss topology design problem from 
Sect.6.1.1 with actuators of the first type. We introduce the binary variables z € 
{0, 1}© with ze = 1, if bar e € £ is active and ze = 0 otherwise. For all bars e, let 
f™™ © R be the maximal force that can be applied to the truss by the actuator and 
let a. € [0, 1] describe the exposure of the actuator, if the bar is active. By 


Fe) = ti =) zeae f™ : ae € [0, 1] fore € e} 
ec€ 


we denote the set of all possible forces which the actuators given by z can implement. 
The goal is to choose the cross-sectional areas x € RÉ, z € {0, 1}£ and the counter- 
forces f% € F*"(z), in such a way that the compliance 5 fu is minimal under the 
worst-case scenario with respect to the uncertainty of the force f. This leads to 


min max min (f+ f%'u 
zelo n, fU freF*(z) 2 fO 
xeR{ (6.10) 
st. AG)u = f + f°, > lexe < Vaux, X ze <N, 


ec€ ec€ 
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Fig. 6.2 Exemplary reduction of material for an optimised active/passive truss: a optimal passive, 
robust truss, b optimal active, robust truss with N = 4 grey active beams, c ratio of the total volume 
of optimised active trusses including penalty term and passive ones, depending on blocking force 
FBlock and penalty parameter 7) 


where N is an upper bound for the number of active bars. In order to solve this 
problem, a key step in [75] is the splitting of (6.10) into an inner and an outer problem. 
The outer problem, which involves the decision for the binary variables z € {0, 1y, 
is solved by a Branch-and-Bound-type method. The remaining inner problem can be 
reformulated as a nonlinear SDP similarly to Sect. 6.1.1. This problem is solved by 
a sequential SDP algorithm, see [75]. We can analogously minimise the volume of a 
truss, where the compliance has to stay below an upper bound Cmax. This leads to a 
similar optimisation problem as (6.10). 

Finally, we present the example of Fig. 6.2 also given in Sect. 3.4 to show that 
the usage of actuators can lead to substantial material savings. This also leads to 
significantly different trusses with minimal volume as shown by an optimal truss 
without actuators (N = 0), Fig. 6.2a, and with (N = 4) actuators, Fig. 6.2b. However, 
this does not consider the trade-off between potential actuator costs and material 
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savings. Therefore, we show results in which we use the objective 


min z lex +7 >. ze 


ze{0, 4° ,xeRf eeE ec€ 


for some actuator penalty parameter 77. In the computations we model piezoelectric 
actuators for which f,""* is given by 


2Exe 


max _ 
J = 2EXe + leKact 


Block > 


where E is the Young’s modulus of the used material, xe denotes the cross-sectional 
area and le the length of bar e, Kact denotes the stiffness of the actuator and Feiock 
the blocking force. This problem can be solved with the methods described above. 
In Fig. 6.2c, we illustrate the results for varying blocking force Fgiock and penalty 
parameter 7) using the ratio of the total volume for the active case including penalty 
term and the total volume for the passive case. We see again that material savings 
are possible. However, high actuator costs can balance these savings. 


Optimal feedback controller design 


If we consider dynamic load scenarios, the reduction of structural vibrations with 
uncertain inputs, such as uncertain loads acting on a truss, becomes important. The 
usage of adaptive elements is a possibility to achieve this; it makes mechanical 
structures safer and more resistant against effects of external disturbances. These 
components consist of a sensor, a control unit and an actuator, thus compensating 
external forces acting on the structure. In [111], feedback controllers for the adaptive 
components are considered, which produce a response f® (t) to external inputs based 
on a measurement of the current state y(t), i.e. f(t) = Ky(t) for a matrix K € 
IRdr dr, Then the system of first order differential equations from Sect.6.1.1 reads 


yt) = P(x) yO) + BAQA ++K yO), ut) = Lyt), fort >0, 
u(0)=0, u(0)=0. 


Here, Q a(t) € RY describes the uncertain loads lying in an ellipsoidal uncertainty 
set U = {f = Qa: lal LR, Rs) Z 1}. For more details concerning the matrices 
P(x), B(x), L e R“*dr see Sect. 6.1.1. The matrix K is added to the Robust 
Dynamic Truss Topology Design Problem (6.9) as an additional optimisation vari- 
able. The corresponding optimal control problem is then given by 
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. 2 2 2 
min y+ evllV lle + exllKllp + ewll Wile 

xeRZ,yeR}, 

K,Y,WeR“r*r 


(P(x) + Bi&)K)'Y+Y(P(x)+B(@&)K)YB@)Q LT 


s.t. Q' B(x) Y -yI 0 | <0, 
L 0 yI 
= Y, —W x 0, Xo hs < Vmax, 
ecE 


(P(x) + B(x)K)'W+ W(P (x) + B(x)K) < 0, 


where £y, €x and ew are positive constants. This optimisation problem can be solved 
by using a sequential SDP algorithm, cf. [111]. 


Active buckling control 


An additional critical failure mode to be considered is buckling due to axial loads. 
In the following, we show its inclusion presented in [64], for the case of discrete 
cross-sectional areas for each bar indicated by binary variables x$, where x? is 1 if 
and only if bar e € E has the cross-sectional area a € A, which we assume to be of 
circular shape, see also Sect. 6.1.1. 

In order to model buckling, we need to know the bar force qe for each bar e. Thus, 
we assume in the following a so-called statically determined truss, which allows to 
compute g using the invertible geometry matrix B and the equilibrium condition 
Bq = f for a given force f. A compressed bar (qe < 0) buckles if the bar force 
exceeds the critical buckling load. For the pinned-pinned Euler buckling case this 
load is given by 7 Ea/4€7, see e.g. [168], where E and £ are the Young’s modulus 
and the bar’s length, respectively. For a bar with area a under tension (qe > 0) an 
upper bound is given by oo a, where oo is the proportional limit after which the 
stress-strain curve deviates from the linearity, see [44]. 

Buckling can be avoided by increasing the diameters of the bars. Alternatively, 
actuators, as presented in Sect. 5.4.7, can be used to avoid buckling by increasing the 
critical buckling load of a bar. To optimally place these active elements into the truss 
structure, we assume their buckling load increase p to be additive and independent 
of the bar area. Then the binary variables ze, indicating whether the bar e is active, 
can be combined with the discussed buckling constraints in the inequalities 


nEa? P ä 
xl - px <<) ax. 
acA G acA 


If one minimises the volume of the truss for a given upper bound on the compli- 
ance Cmax, a bound N on the number of active bars and a polyhedral uncertainty set 
with forces S = { fi,..., fs}, we obtain the following mixed-integer SDP 
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Fig. 6.3 Example truss for an active buckling control for two load scenarios: a ground-structure, 
br = 0 active bars ander = 2 active bars [64] 
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We solve this problem using SCIP-SDP [147], see also Sect. 6.1.1. Exemplary, 
Fig. 6.3 shows optimal solutions, when minimising the total bar volume for two 
load-scenarios using no or at most two actuators on the ground-structure given by 
Fig. 6.3a. Without actuators one bar has to be bigger than the others, see Fig. 6.3b. 
Replacing this bar by an active one, the solution can be improved to use the smallest 
diameter everywhere, see Fig. 6.3c. 


Optimal design of shunt damping 


In addition to the methods described above, one can use shunted piezoelectric trans- 
ducers to attenuate structural vibrations in mechanical systems, cf. Sect. 5.4.6. The 
attenuation of vibration strongly depends on the choice of the shunt parameters, 
where uncertainty in design and application may lead to a loss of attenuation perfor- 
mance. In [112], the Bounded Real Lemma is applied to formulate the corresponding 
optimisation problem as a nonlinear SDP, which is solved using a sequential SDP 
method for a demonstrating example. 
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Conclusion 


In this section we described four mathematical models to incorporate active elements 
into the robust truss models as presented in Sect. 6.1.1 to handle uncertainty in load- 
bearing structures. The new models are more complex and often require new solving 
algorithms. Here, the forces acting on the nodes of the truss are considered to be 
uncertain. Section 6.3.4 extends this idea by also considering arbitrary bar-failures. 


6.1.3 Mathematical Optimisation in Robust Product Design 
Philip Kolvenbach, Alexander Matei, and Stefan Ulbrich 


Optimisation tasks in engineering applications are usually described by (nonlinear) 
mathematical models and are often based on partial differential equations (PDE). 
However, these models depend on uncertain data in virtually every real-world appli- 
cation, for example, in the form of parameters that are not known exactly, cf. Sect. 2.1. 
In the context of mathematical optimisation, it is well known that optimal solutions 
are often sensitive to the problem data to such an extent that even small perturbations 
in the uncertain data can severely reduce the quality of a solution and might even 
cause a solution to violate important design and safety constraints. As aconsequence, 
it is very important to take uncertainty into account during the optimisation process 
in early stage product design, cf. Sect. 3.1. One approach to achieve this is through 
robust optimisation, see also Sect. 6.1. In this subsection, a mathematical method to 
deal with robustness in the PDE-setting is depicted and applied to a truss structure 
that is derived from the Modular Active Spring-Damper System, see Sect. 3.6.1, and 
an integrated sensor element. 

This exposition is based on [107, 150], which substantially extends the methods 
presented in [43, 178] by using a second order approximation instead of a lineari- 
sation of the worst-case function. Further methods to deal with nonlinear robust 
optimisation are investigated by [20, 36, 93, 121]. 


Robust optimisation as a two-level problem 
Recall the nominal optimisation problem from Sect. 6.1 

min fan st f'@,p) =0, fori <I, (6.11) 
and its robust counterpart 


min max fla, p) s4. fa, p)<0, foriel, forpedu, (6.12) 
x pe 
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where x is the optimisation (or design) variable, p € U is a vector of uncertain 
parameters from an uncertainty set U, f° is the scalar objective function, and f', 
i € I, are finitely many scalar constraint functions. 

In the case at hand, the objective and constraint functions depend on the physical 
state of the system, which in the following is the solution of a PDE. Therefore, the 
methods presented in Sects. 6.1.1 and 6.1.2 are no longer applicable and we develop 
alternative techniques. Problem (6.12) has infinitely many constraints but is easily 
seen to be equivalent to a two-level problem with finitely many constraints, i.e. 


min max f°(x,p) s.t. max f'(x,p) <0, foriel. 
x peu pou 


The optimisation problem can be further simplified by using the worst-case functions 
© (x) = max{ fi (x, p) : p € U}, i € Ip = I U {0}, which yields 


min (x) st. ® (x) <0, foriel. (6.13) 


While quite similar to (6.11) in form, the so-called robust counterpart (6.13) is 
decisively more difficult to solve because of its two-level structure and, in particular, 
because the lower-level maximisation problems are generally non-convex, but need to 
be solved globally in order to evaluate the worst-case functions. In addition, the worst- 
case functions are generally non-smooth functions, which hinders the application of 
efficient gradient-based optimisation methods. Even so, there has been considerable 
progress in the field of non-smooth constrained optimisation in recent years, such that 
suitable optimisation methods for (6.13) exist and are openly available; for example, 
see [38, 39]. 

An alternative way to deal with the non-smoothness is to lift optimality condi- 
tions, if available, of the lower-level problems to the upper-level problem, thereby 
obtaining an often smooth, single-level mathematical program with complementar- 
ity conditions (MPCC) eligible to tailored sequential quadratic programming (SQP) 
methods, see [114, 150]. 

The other difficulty—having to globally solve non-convex programs—is much 
more severe, especially in applications that involve PDE that make function eval- 
uations of fi, i € Io, extremely expensive. One approach is to approximate the 
functions p +> f'(x, p), i € Io, by Taylor models of first or second order; see [6, 
43, 107-109, 150, 151]. Once the models are built, their global maxima (i.e. their 
worst cases) can be computed very efficiently without further function evaluations 
of p œ> f'(x, p) and, hence, without further solving expensive PDE. Since Taylor 
models can only be expected to be locally accurate, strategies have been investigated 
to iteratively move the model expansion point in the course of the optimisation in 
order to increase the quality of approximation by closing the gap between the model 
and the modelled functions [6, 114]. In the following, we apply this approach to two 
examples of shape optimisation problems from structural mechanics. 
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Fig. 6.4 a Initial truss with the position of the uncertain load, b—c snapshot of the displacements y 
in the optimal non-robust truss (b) and the optimal robust truss (c) under their respective worst-case 
dynamic load [107] 


Example 1: a truss structure subject to uncertain dynamic load 


As a first example, we consider a truss structure with 18 bars and ten connector 
nodes, see Fig. 6.4a, also considered in [107, 108]. The truss supported at two of its 
outer nodes is subject to an uncertain time-dependent diagonal load at the bottom, 
indicated by an arrow and an ellipse. The goal is to redistribute the volume between 
the 18 bars so as to minimise the L?-norm of the displacement over space and time, 
with identical upper and lower bounds for all bar volumes. The physical behaviour is 
modelled by an equation of motion with linear elasticity. This PDE is discretised in 
space with a standard finite element method and a Newmark method in time, which 
leads to more than four million degrees of freedom in total. A scaled 10 % ellipsoid in 
the space-time domain, which is centred around a constant diagonal force, is chosen 
as the uncertainty set for the load. 

Figures 6.4b, c show the optimal non-robust and optimal robust truss structures 
under their respective worst-case loads at the time point of maximum displacement; 
the greyscale indicates the von-Mises stress in MPa. The dynamic behaviour of the 
non-robust and the robust truss structures is displayed in the plots of Fig. 6.5. From 
both figures we infer that the non-robust structure not only has a considerably larger 
scale on the displacement y (tg), but it is also clearly susceptible to resonance on the 
fixed time interval, unlike the robust structure. These observations illustrate that the 
worst-case behaviour of the robust structure is much better—in terms of the objective 
function by a factor of 13 in this example, compare Table 6.2. 

Table 6.2 also demonstrates the cost of robustness in terms of the number of 
additional PDE that have to be solved (PDE s.). Even so, the increase can be mitigated 
by a factor of 10 by utilising specialised, i.e. so-called matrix-free, second-order 
optimisation methods for the lower-level problems; see row “Robust-2”. 


Example 2: sensor element with manufacturing tolerance 
When uncertainty is taken into account during the design phase of a mechanical 


structure, the designer usually has to have specific knowledge on the source of uncer- 
tainty. Since it is often too demanding to assume all potential sources of uncertainty 
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Fig. 6.5 Worst-case dynamic behaviour of a the non-robust and b the robust truss structures. In 
both plots, on the left axis, (—) is the magnitude of the worst-case load over time in N, (-----) 
is the accumulated L?-norm of the worst-case load over time and on the right axis, (- - -) is the 
accumulated L?-norm of the displacement in space in mm [107] 


Table 6.2 Relative worst-case objective, number of optimisation iterations (it), number of steps 
that were fully accepted by the line search (fsteps) and number of solved PDE (PDE s.) for different 
truss optimisation methods [107] 


Method Rel. worst-case objectiveit fsteps PDE s. 
Non-robust 13.25 146 142 450 
Robust 1.00 143 127 339928 
Robust-2 1.02 67 61 3672 


are known, it is crucial to monitor safety-related structures during their usage phase. 
As an example, we consider a novel manufacturing process that integrates sensors 
into the inside of metallic structures such as bars enabling such monitoring; see 
Fig. 6.6. Specifically for bars, the sensor element needs to be sensitive to axial loads, 
but insensitive to transverse forces. At the same time, it should not be too sensitive, 
because otherwise the signal-to-noise ratio becomes unfavourable. In a collabora- 
tion between mathematicians and mechanical engineers [107, 109], we modelled 
this task as a shape optimisation problem. A robust optimisation approach has been 
applied in order to preserve the desirable sensor properties despite manufacturing 
tolerances. The physics are modelled by the three-dimensional equations of linear 
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Fig. 6.6 a Sensory tube within the truss bars of the MAFDS, see Sect. 3.6.1 and [109], b FEM 
model of sensor body within the tube [107] 
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Fig. 6.7 Mantle view of the sensor element for a the optimal non-robust design and b the optimal 
robust design [107] 


elasticity, which are solved with a finite element method with about 750 000 degrees 
of freedom in total. 

Figure 6.7 shows the mantle of the cylindrically shaped sensor elements for the 
non-robust and the robust solution, respectively. The white areas are holes cut into the 
steel, compare to Fig. 6.6b; their shape is parameterised by cubic Bézier curves and 
chosen during optimisation. The black vertical lines show the desired but uncertain 
position of the four strain gauges used to measure the axial loads. The optimisation 
results are given in Table 6.3, where q stands for the ratio between transverse and 
tensile sensitivity (smaller is better) and ||c || for the relative constraint violation of 
the sensitivity bounds. In both cases, the prefix “max” indicates the respective value 
in the worst case under manufacturing tolerance. It can be seen that the robust solution 
is feasible in every scenario and even has a better worst-case sensitivity ratio than the 
non-robust solution, at the cost of a slightly worse sensitivity ratio in the undisturbed 
case, and greater computational effort (see columns it and eval). The optimal robust 
design, Fig.6.7b, shows a perfect symmetry even though there was no symmetry 
constraint given. This result can be explained by the observation that tensile strains 
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Table 6.3 Optimisation results for the different problems and methods. The table displays the 
objective function value (q), the constraint violation at the respective solution (||c+||) and their 
robust counterpart function value (max q, max||c+||), both for the non-robust/undisturbed and for 
the robust problem. Also the number of iterations (it) and the number of objective function and 
constraint evaluations (eval) are given 


Problem q max q |c+ll max||c+ || it eval 
Non-robust |1 1 0 0.7369 41 153 
Robust 1.0274 0.9566 0 0 192 467 


at one bar cause compression strains at the opposing bar. Thus, the solver tends to 
solutions in which opposing bars have nearly the same geometry. Furthermore, the 
cross-section of the bars has been reduced by the optimisation algorithm. This leads 
to an increase in the observed strains which seems very plausible since the solver 
has the task to increase the sensitivity of the sensor. 


Conclusion 


In conclusion, we have seen that second order approximations of the robust counter- 
part with moving model expansion point perform well in PDE-constrained optimisa- 
tion of mechanical structures. This method is indeed able to increase the robustness 
and efficiency of structural components in various applications. 


6.1.4 Quantified Programs 
Ulf Lorenz, Marc E. Pfetsch, and Andreas Schmitt 


Uncertainty is ubiquitous in the production phase, as well as in the usage phase of 
products, see Sect. 1.2. On the one hand, random fluctuations in the properties of the 
semi-finished parts or the raw material occur; on the other hand, uncertainty results 
from unpredictable process behaviour, or due to the fact that the behaviour of the 
end customers is difficult to predict, see also Sect. 3.2. In this section, we showcase 
a mathematical modelling and optimisation method, which was developed to master 
uncertainty in process chains. 

The goal isto provide a general framework to optimally solve multi-stage decision- 
making problems under uncertainty. To model this structure, the class of optimisation 
programs termed quantified problems (QP) by Subramani [156] is used. In these 
problems, each variable is associated with the existential or universal quantifier. This 
corresponds to the mentioned multi-stage structure, in which variables depend on 
the variables of previous stages. Therefore, we are able to model problems with a 
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dynamic structure, e.g. decisions have to be made before an uncertain outcome is 
revealed. 

Quantified programming has close ties to robust optimisation as introduced in 
Sect.6.1. In fact, the decision version of every (integer) linear robust optimisation 
problem with an interval uncertainty set U can be modelled as a quantified linear 
program consisting of existential quantifiers followed by universal quantifiers. How- 
ever, due to the possibility of a mixed appearance of the two kinds of quantifiers 
leading to more than two stages, but also due to the integrality constraints, more 
general methods than the ones presented in Sects. 6.1.1, 6.1.2 and 6.1.3 are needed. 
In this section we present theoretical results and extensions to the QP-framework. 


Quantified programs 


A quantified linear program (QLP) is the problem to decide whether the following 
logic formula in real variables x1, ..., x, holds: 


ax = lEn uy] Vx2 € [&, u2] see Axn-1 € [&n-1; Un—1] VXn € [ens un] : Ax = b. 


Here, n is even, £, u € Z" are lower and upper bounds, and the coefficient matrix 
A € Q”*” as well as the vector b € Q” define the linear constraints Ax < b. An 
arbitrary sequence of universally and existentially quantified variables is possible by 
including dummy variables. A quantified integer program (QIP) additionally restricts 
the variables to attain integral values. 

One interpretation of quantified programs is given via two-person zero-sum 
games: The existential player plays against the universal player. During the game, 
the values of the existential (4) and universal (V) quantified variables are chosen 
in order 1 to n by the corresponding player in the given variable bounds [£, u]. In 
iteration i, the previous values x; to x;_, are known. The existential player wins if 
the condition Ax < b holds. The question is whether there is a winning-strategy for 
the existential player, i.e. can this player win the game independently of the universal 
player’s actions? 

An illustration is the design and time-discretised operation of a technical system 
under an uncertain and time-varying load. If lower and upper bounds to the load 
are known, the first block of existential variables could model the selection of com- 
ponents, whereas the f-th following pair of universally and existentially quantified 
variable blocks models the worst-case load and the corresponding system’s opera- 
tion at time r. In this way, the solution design will be able to handle every possible 
combination of loads. 


Properties and extensions 


Itis known that QLP is coNP-hard and QIP is PSPACE-complete [157], i.e. their solu- 
tion is theoretically hard, but QIPs make it possible to model a wide range of applica- 
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tions. The expressiveness of QIPs has been shown by using it to model the classical 
job-shop and car-sequencing scheduling problems in [49] and the PSPACE-complete 
game Go-Moku in [50]. Polyhedral properties have been researched in [118]. 

If there even exist several winning strategies for the existential player, a best 
choice with respect to a given measure can be considered. One example, see [119], 
is a min-max-objective for a vector of objective coefficients c € Q”: 


min (cm + ( max czx2+( min c3x3 + (... max CnXn + F(x)).. ))). 


xıellı,un] x2€[2,u2] x3 €[€3,U3] Xn€lln Un] 


where F(x) = 0 if x satisfies Ax < b and F(x) = o otherwise. Thus, an optimal 
solution will be a winning strategy of the existential player with minimal cost and 
minimal worst-case cost of the universal player. This extension has greater expressive 
power. Problems with objective functions composed of costs or efficiency can be 
treated. 

In recent works [77, 80], the above framework is extended to bound also the uni- 
versally quantified variables using a polytope. Here, a player loses, if she is the first 
not being able to satisfy her system of inequalities. This makes it easier to formulate 
problems involving more constraints on universal variables, e.g., the maintenance of 
a machine (3-variable) prevents its failure (V-variable). Instances of this extension 
can be reduced to greater but polynomial sized instances of the interval case. Thus, 
obstacles when formulating application-problems as QIP are simplified without rais- 
ing theoretical complexities. 

To solve quantified programs, different techniques can be used. As it has been 
noted early in the literature, see [48], one possibility is to use the so-called determin- 
istic equivalent problem (DEP), which contains the existential variables and includes 
the universal variables placed at their bounds for QLP or their integer feasible values 
for QIP. The multi-stage character of problems makes it possible to use a specialised 
nested Benders decomposition to solve the DEP of a QLP [48]. The interpretation 
as a game motivates the usage of the Alphabeta algorithm as shown in [51, 120]. 
By reordering the quantifiers in a given quantified program, the so called quantifier 
shifting, an efficient relaxation can be formed [174]. Further, a pruning technique is 
shown to be computationally efficient in [79]. 

These and more techniques are applied in the QIP-solver Yasol [47], which is 
used, e.g. to solve a resilient booster design problem [78]. 


Conclusion 


Quantified programming is a framework to model multi-stage structure in optimisa- 
tion problems. Many QIPs were solved by using the DEP, as implicitly done in [8] 
and [141]. Future research will hopefully allow to replace algorithms based on DEPs 
by improved methods, equally leading to a wider applicability of QIPs. 
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6.1.5 Mastering of Disturbing Influences in Early Phases 
of Product Development 


Fiona Schulte and Hermann Kloberdanz 


In principle, robust design follows the same objective as sustainable design. This 
means that products should be developed with regard to functionality, costs and 
availability to ensure that acceptance is by and large guaranteed, as described in the 
Sects. 1.6 and 3.5. This equally includes very different product usages and future 
changes in the entire product life cycle. The challenge for developers is particularly 
high when products are newly developed and when they have little experience with 
the planned product usage. This section presents how robust design can be applied 
to meet increased expectations, especially for new types of usage with intensive 
disturbance effects. 

In view of rapidly changing technologies, markets and customer needs, innovative 
products are of great importance for the sustainable success of companies. New 
production processes and process chains as well as new types of usage processes and 
environments offer opportunities for the successful marketing of innovative products. 
However, their development is also associated with a high risk due to uncertainty. 

Frequently, a high degree of innovation can only be achieved by developing a 
product from scratch. A lack of experience and missing reference products as well as 
working at a high level of abstraction at the beginning of the development represent 
great challenges. In particular, developers have to make far-reaching decisions in 
the early stages of the development process, even though the product is still widely 
unknown. Overall, the situation is characterised by a lack of reliable information, 
which correlates with a high degree of uncertainty as introduced in Sect. 1.3 There- 
fore, mastering of uncertainty in the early phases of the development of innovative 
systems is of great importance. In addition, the new development of products and 
systems is very complex, since almost all properties have to be defined depending 
on different requirements, cf. [12]. 

To master the complexity, developments of new systems are performed systemat- 
ically and supported by methods. Development processes according to the guideline 
VDI 2221 [172] are widely used. This guideline recommends a discursive devel- 
opment process, which is structured according to phases and work steps in which 
defined results are achieved. The basic phases are (i) task clarification and project 
definition, (ii) concept development, (iii) embodiment design and (iv) detail design. 


Robust design in the early phases of product development 
The first two phases ‘task clarification and project definition’ as well as ‘concept 


development’ are called the early phases of product development [22]. In these phases 
the basic characteristics of the products and systems to be developed are defined. 
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Especially in innovation projects, the early phases are intensified, as the devel- 
opers are able to greatly influence the subsequent production processes and usage 
properties here, thus making a significant contribution to the success of the product. 
On an abstract level, models of functional structures, physical effects and working 
principles are developed. Deviations from the ideal function, disturbance parameters 
and their influences are only rudimentarily known and initially not taken into account 
in solution synthesis. The current robust design methods therefore focus mainly on 
the ‘embodiment design’ and ‘detail design’, where more concrete models of the 
developed product are already available [52, 124]. 

However, the full potential for mastering uncertainty can only be exploited if 
robustness is considered as a central criterion from the beginning of the development 
process [12]. Therefore, we developed further robust design methods for the early 
phases of product development [124, 125]. These methods provide a decisive way 
to master uncertainty in innovation projects. 

In the early phases of product development, products and systems are only mod- 
elled in the form of process models and functional structures, see Sects. 5.2.3 
and 5.1.2. Since these models contain little specific information about the system 
to be developed, they are poorly suited for mathematical modelling and simulation. 
Therefore, methods that support developers in the synthesis of robust concepts are 
more important than analytical methods. Methods to support system syntheses ide- 
ally complement the uncertainty analysis according to the UMEA methodology from 
Sect. 5.2.1 and support robust design by providing additional models and tools. 

In the following we focus on two essential elements of the robust design method- 
ology for early phases: 


e assessment of sources of uncertainty based on physical effects: Sources of uncer- 
tainty can be identified comprehensively with checklists mainly based on physical 
effects. The checklists are compatible with the robustness evaluation of principal 
solutions during concept development. 

e strategies of mastering uncertainty caused by disturbance parameters: The strate- 
gies describe the principle mastering of uncertainty caused by disturbances and 
serve as an orientation for the development of solution approaches and their pri- 
oritisation. 


Assessment of uncertainty source in early phases of product development 


In case of new product developments, the systems are considered as a whole in the 
‘task clarification and project definition’ phase. Mainly, the process model is used to 
analyse the overall system in detail with regard to the expected benefits, the fulfilment 
of functions and the corresponding relationships with the system environment as 
shown in Sect. 5.2.3. On one hand, the planned use of resources and operation of 
the system, and on the other hand, disturbance parameters from the environment, as 
well as disturbing side effects on the system environment are considered. 
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Fig. 6.8 Structure of checklists for disturbance identification in early phases of product develop- 
ment based on physical effects 


With regard to robust design, especially potential disturbances and side effects 
have to be recognised, since they are the main identifiable sources of uncertainty in 
this phase. Side effects may not be acceptable, if they do not comply with restrictions, 
while disturbances can reduce the system’s performance as described in Sect. 5.2.3. 
In the ‘task clarification and project definition’ phase, the developers can be sup- 
ported especially by checklists for the determination of potential disturbance param- 
eters. The usefulness of such checklists is mainly determined by their applicability. 
The applicability of the checklist is based on the checklist’s structure, completeness 
and handling due to their scope and versatility listing the sources of uncertainty. 
The checklist’s focus on physical effects is purposeful, since a substantial part of 
the causes of disturbances is considered and can be structured in a well-founded 
way [124]. 

In addition, detected disturbance influences can be assigned to principle solutions 
during concept development, which allows a simple robustness evaluation of the 
solutions as shown below. Furthermore, the sole consideration of physical effects 
is not sufficient for the complete detection of potential disturbance parameters as 
Mathias states [124]. For example, uncertainty due to contamination or other external 
influences must be added based on experience. For load-bearing systems, in addition, 
it is purposeful to emphasise aspects of force flow. We therefore propose the structure 
shown in Fig. 6.8, based on the proposal of Mathias. 

These checklists primarily support the identification of relevant disturbance 
parameters as safety-relevant requirements and their documentation in requirement 
lists. These serve as a basis for decision-making in the entire development process 
as discussed in Sect. 5.1. 
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Strategies of mastering uncertainty in early phases of product 
development 


Furthermore, developers can be supported effectively in their search for solutions 
using reference objects as orientation. In the phase of ‘concept development’, very 
basic strategies and principles prove to be suitable as work is done at a high level 
of abstraction. The analysis of the system’s vulnerability follows the analysis of the 
system environment with regard to disturbance parameters as indicated in Fig. 6.9. 
Vulnerability describes the possibility of serious functional disorders of the system 
due to external disturbances. Both, the exposure and sensitivity of the system to 
the disturbance parameters, must be taken into account. Therefore, we derived three 
basic strategies for the development of robust concepts from the chain of effects of 
disturbance parameters as shown in Fig. 6.9: (i) eliminate disturbance parameters, 
(ii) reduce (or eliminate) the influence of disturbance parameters, (iii) avoid the 
impact of disturbance parameters, cf. [124, 125]. 

The elimination of disturbance parameters means to use the system only in an envi- 
ronment where no relevant disturbance parameters are present. Solutions restricted 
to these conditions are known as, for example, air-conditioned measuring rooms 
and particle-free clean rooms. For load-bearing systems, such solutions usually are 
impracticable or not very effective, since their area of application would be restricted. 

The reduction of the influence of disturbance parameters is a frequently used strat- 
egy. In most cases shields, insulations, seals, housings or surface coatings reduce the 
influence of radiation, dirt or mechanical impact. These approaches can be under- 
stood as robust design in a broader sense. However, the application of this strategy 
is mostly associated with additional measures or components. Protective measures 
are often not an optimal solution in terms of additional effort, limited effectiveness 
and additional uncertainty. 

By contrast, solutions that are based on the strategy to avoid the impact of distur- 
bance parameters are understood as robust design in a narrower sense [12]. Typical 
robust solution approaches select functional principles based on physical effects that 
are basically not or only slightly influenced by the expected disturbance parame- 
ters [125]. For example, extreme temperatures have less effect on mechanical solu- 
tion principles than on electronic solutions. Conversely, electronic components e.g. 
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Fig. 6.9 Robust design strategies of mastering uncertainty caused by disturbance parameters in 
early phases of the product development, cf. [126] 
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engine control units are less sensitive to strong accelerations. The strategy to avoid 
the impact of disturbance parameters must be prioritised because in most cases the 
overall solution is more cost effective and incorporates less uncertainty. In most cases, 
additional effort can be avoided from the beginning by considering the corresponding 
uncertainty. 

The strategy to avoid the impact of disturbance parameters can also be applied in 
the ‘embodiment design’ phase. For example, a symmetrical design of components 
or materials with a high thermal conductivity can avoid component distortion due to 
heat impacts and the associated functional impairment as shown in [124]. 

In the ‘concept development’ phase basic solutions are determined. The principle 
solutions are described by the underlying physical effects, working principles and 
working structures, and are presented as simple sketches [22]. Due to the high degree 
of abstraction, uncertainty regarding the flow of forces cannot be estimated at this 
stage of the development process. 

However, potential uncertainty influences can be estimated based on a principal 
evaluation of the robustness [124]. A rough estimation of uncertainty can be done 
by evaluating the principal correlations between the identified disturbances and the 
physical effects on which the intended overall solution is based. Thus, to assess 
the robustness of solutions on the principle level, only the influences of disturbance 
parameters on physical effects need to be known. This method abstracts the approach 
of Taguchi [162], that is based on the signal-to-noise ratio for the evaluation of the 
robustness. However, an exact calculation of the signal-to-noise ratio representing the 
robustness properties of the system, as Taguchi strives for as discussed in Sect. 3.5, is 
neither possible nor necessary at this stage of the development. An estimation of the 
basic sensitivity to disturbance parameters is adequate for assessing uncertainty in 
this early phase. The sensitivity of physical effects to disturbances was summarised 
by Mathias in tables [124]. In addition, equations for the calculation of principal 
robustness values have been developed, which, however, are only suitable for a 
relative comparison of alternative solutions of the same system. 


Conclusion 


In the early phases of the development of new innovative products, the robust design 
approach contributes significantly to mastering uncertainty from the very beginning. 
In particular, it can be seen as a success factor in case of lack of experience. 

The identification of disturbance parameters and the selection of suitable robust 
design strategies provide a reliable basis for the subsequent development work. 
According to the high level of abstraction, qualitative methods are applied. These 
methods provide only partially quantifiable guidance. It is very challenging for the 
developers to anticipate the systems to be developed with their properties and usage 
including uncertainty. 
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6.1.6 Uncertainty-Based Product Design in Robust Design 
Hermann Kloberdanz, Fiona Schulte, and Eckhard Kirchner 


A technical system is said to be robust, when it does not only fulfil its predefined 
function at the design point, but also in the surrounding neighbourhood, the so-called 
uncertainty set. The accepted functional quality is guaranteed even under uncertain 
resources or disturbances by uncertain external influences as defined in Sect. 3.5. 
Both, the constructional design and the development process of such systems, are 
referred to as robust design. The basic idea was developed by Genichi Taguchi [161, 
162] and refined several times over decades, e.g. by Ulrich and Eppinger [170]. The 
characteristic of the system perceived by the user during usage under the influence of 
disturbance parameters is decisive and is determined by uncertainty [76]. Therefore, 
uncertainty has to be considered in the context with all phases of the product life 
cycle as described in Sect. 3.2. In this section, we show how and by which measures 
in the design of parts and components uncertainty can be mastered over all phases 
of the product life cycle in the sense of robust design. 

Uncertainty in load-bearing systems mainly affects the performance of the force 
transmission function. Unacceptable deformations or damage to the system or its 
components are typical functional deviations. The load carrying capacity of such 
systems is mainly determined by the life cycle phases prior to product use Sect. 1.2. 
The product components are manufactured and assembled in production processes. 
These processes are performed by work equipment e.g. machine tools. Similar to 
usage processes, uncertainty also influences the production processes. Uncertainty 
of the network of manufacturing and assembly processes accumulates in deviations 
from product properties as explained in Sect. 5.2.3. A comprehensive mastering of 
uncertainty in robust design must therefore take all processes in the product life cycle 
into account when designing products and their components. 

As a consequence, robust design demands that three basic requirements must be 
considered when developing load-bearing products: 


e the products must prove to be insensitive to disturbance parameters in usage pro- 
cesses, 

e uncertainty of the production processes may only accumulate to a small extent in 
the process chains or must even be able to be reduced, 

e it must be possible to produce the components of the products with low uncertainty 
in critical processes. 


The basic approach of robust design is to master uncertainty in the entire life cycle 
process network by designing the products. Therefore, we refer to this approach as 
process oriented robust design. This means that all life cycle processes and their inter- 
actions are not directly but indirectly defined by the embodiment design properties 
of the product components. In other words, process oriented robust design strives to 
reduce uncertainty of the properties of parts and components through their design by 
producing them in the tightest possible tolerances without additional effort or even 
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with reduced effort. Process orientated robust design can therefore make an essential 
contribution to mastering uncertainty of load-bearing systems as part of life cycle 
engineering. 


Mastering uncertainty caused by usage process influences 


Uncertainty of system functions in usage processes comprises three types of sources: 


e direct or indirect effect of external influences on the system or components of the 
system in usage processes (external usage uncertainty), 

e mutual influence of the components of the system through side effects and inter- 
actions in usage processes (internal usage uncertainty of the system) 

e deviation of the properties of the product acting as work equipment in the usage 
process which result from the previous life cycle processes (internal uncertainty 
of the system). 


Well-known approaches of robust design e.g. Ulrich and Eppinger [170] assume 
that external and internal uncertainty in load-bearing systems during usage can be 
mastered mainly by the design of the mechanical components. The mechanical com- 
ponents form the essential part of load-bearing products in mechanical engineering. 
They guide and transfer the forces in usage processes and are referred to collectively 
as mechanical system. Therefore, the comprehensive mastering of uncertainty by the 
design of the components of load-bearing products in the embodiment design phase 
is in the focus of the consideration. 

While robust design in early phases considers the product as a whole, see 
Sect. 6.1.5, the consideration of uncertainty in the embodiment design requires more 
detailed models as the solutions become more specific. Therefore, we have further 
detailed the model of technical processes presented in Sect. 5.2.3 for depicting the 
mechanical system in order to categorise the sources of uncertainty like in Fig. 6.10. 
In addition to the external disturbance parameters in the usage processes outlined in 
Sect. 6.1.5, sources of uncertainty can be depicted in this model due to varying func- 
tions of the components with regard to the force flow and the interacting influence 
of the components. In this way it is possible to locate typical sources of uncertainty 
regarding power transmission within the mechanical system. 

In the example of the 3D Servo Press introduced in Sect. 3.6.3 servo motors 
generate the drive forces. However, the heat loss that is generated can heat up the 
transformer components and thus influence the power transmission as well as the 
ram movement and position. These dependencies can be illustrated and analysed 
analogous to the robust design approach in the early phase of the specialisation of 
the detailed generic process model according to Fig. 6.10. 

Uncertainty due to external influences and mutual influence of the components 
can be mastered in embodiment design analogous to the strategies in the early phases. 
In particular, ensuring an unambiguous force transmission can reduce the effect of 
uncertainty influences [57, 60]. This approach is also known as design for clarity [59]. 
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Fig. 6.10 Extended process model of technical systems, cf. [58] 


Ensuring clarity is of significant importance in robust design. The basic character of 
clarity has already been recognised by Pahl [136] and formulated as the basic rule 
of design. Pahl even demands mandatory compliance with the basic rule of clarity. 
Kirchner has reworked these basic rules recently [103]. Here, clarity means the 
wide degree of independence of the force transmission and the resulting component 
stress from external influences as well as from component and part tolerances. For 
example, in the Modular Active Spring-Damper System, see Sect. 3.6.1, the load is 
clearly initiated via three points. In this way, a deviating force can be clearly recorded 
and the stress on the system components can be clearly calculated. 


Mastering of uncertainty caused by production process influences 


As stated above, robust design strives to minimise the accumulation of uncertainty in 
production processes to reduce deviations in usage processes. Uncertainty especially 
of critical production processes is mainly mastered by the design of the components. 
To cope with the high level of complexity of design and process-related interrelation- 
ships, we developed systematically structured procedures and assistances to support 
the robust design of load-bearing systems [57, 60]. For that, we structured the design 
advices and strategic procedures that serve as an orientation for the development 
of robust load-bearing systems. They are described based on a set of eleven robust 
design effects, see Fig. 6.11. 

The robust design effects were determined based on a systematic analysis of the 
relationships between the properties of the product and in particular its components 
on the one hand and the life cycle processes on the other. These interrelationships 
summarise effective ways of influencing all life cycle processes by product and 
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Fig. 6.11 Robust design strategies and effects for mastering uncertainty in process oriented robust 
design, following [57] 


component design in terms of uncertainty. Thus robust design contributes directly 
and indirectly to mastering uncertainty of product usage. Furthermore, strategies 
were formulated to categorise the robust design effects. The order of the robust 
design strategies and effects recommends a prioritisation of their usage. 

As stated above, ensuring clarity is of significant importance in robust design. 
This applies to mastering uncertainty in both usage and production processes. For 
example, there is ambiguity in force flow, if the mechanical system is kinematically 
overdetermined by multiple power transmission paths with high rigidity. Deviations 
in critical component dimensions usually lead to considerable constraining forces. 
Typical consequences are reduced functionality and unexpectedly high component 
stresses in the system that cannot be reliably calculated and lead to increased com- 
ponent wear. Dimensional deviations are often caused by uncertainty in component 
production, by elastic component deformation or by component deformation as a 
result of temperature influences. Ambiguous designs are generally only acceptable 
by considerable additional effort to guarantee narrow component tolerances. The 
clarity of robust structures can be supported by decoupling of power transmitting 
functions in order to avoid mutual influence of the power transmitting elements. 

The strategy to reduce the sensitivity and exposure of components to disturbances 
corresponds to basic strategies for reducing uncertainty caused by disturbance param- 
eters described in Sect. 6.1.5. While disturbances caused by the usage environment 
can only be reduced or eliminated to a limited extent in the total system, robust 
design offers the possibility of reducing influences (disturbances) from one system 
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element to another. Typical examples are the prevention of waste, heat loss and wear 
particles, which reduce the component strength or can influence the functionality of 
other components through pollution. The influence of most disturbance parameters 
can be reduced or eliminated by robust design, for example by shielding or insula- 
tion. However, this requires additional components and system elements. Therefore, 
generally design solutions according to the robust design effect ‘reduce or eliminate 
effects of disturbance variables’ should be aimed at. As a rule, this can be achieved 
by an appropriate choice of material or component geometry that is insensitive to dis- 
turbance parameters. In order to master uncertainty, unambiguity and low sensitivity 
as prerequisites for robust design should be given the highest priority. 

A detailed description of how robust design effects and strategies can be integrated 
in the development of products and components was provided by Freund [57]. As 
an aid for the application in robust design, he provides a comprehensive catalogue 
with examples (‘RopEx catalog: Design notes for mastering uncertainty in usage 
processes’ (German)) [57]. Typical examples for part and component design clarify 
the abstract robust design strategies and effects. 

The formulation of the robust design strategies and effects presented here is mainly 
based on the power transmission functions of passive mechanical systems. The pre- 
sented procedures, principles and instructions can be transferred analogously to semi- 
active and active systems. 


Conclusion 


The design of the components and parts, which is mainly determined in the embod- 
iment design phase of product development, significantly defines the production 
processes and the interaction of the parts in usage. Thus, the process oriented robust 
design allows to master uncertainty, which arises during product usage due to the 
mutual influence of components and ambiguous force flow. Appropriately struc- 
tured and prioritised robust design strategies and effects effectively support product 
developers by providing orientation. The applicability is considerably improved by 
demonstrative examples. 


6.1.7 Non-linear Robust Closed-Loop Control of Presses with 
Geometric Singularities 


Florian Hoppe, Dirk A. Molitor, and Peter Groche 


Servo presses like the 3D Servo Press presented in Sect. 3.6.3 fulfil the purpose 
of producing metal-formed parts with high accuracy. Besides increasing the pas- 
sive stiffness, active compensation measures in terms of closed-loop control have 
been established. Control laws are based on knowledge about the machine model, 
e.g. robot control mainly focuses on inverse kinematic models [152]. Especially 


398 M. E. Pfetsch et al. 


kinematic singularities are very sensitive to uncertainty and require a high model 
accuracy. A kinematic model is typically based on the assumption of rigid bod- 
ies that are connected by rigid joints. Uncertainty affects the whole lifecycle of a 
product, cf. Sect. 1.2. In the case of a press, uncertainty occurs in form of inac- 
curacies during production and assembly, as well as thermal or elastic expansion 
during its use. Therefore, the geometric dimensions of the machine components are 
not exactly known. This data uncertainty as well as model uncertainty arising from 
ignored relevant physical phenomena, cf. Sects. 2.1 and 2, result in instable regions 
at the kinematic singularities, i.e. the top dead centre (TDC) and bottom dead centre 
(BDC). While methods based on stiffness models presented in Sect. 5.4.1 are able to 
reduce this uncertainty, they are not able to eliminate it [71]. An alternative approach 
is to accept the uncertainty and to increase the robustness of a control. Robust meth- 
ods seek to reduce the impact of uncertainty on the worst-case scenario, which is the 
control near a singularity. 

Servo presses are electromechanical systems consisting of a controlled servo drive 
and a mechanical gear. The most common gear kinematics are eccentric and knuckle- 
joint kinematics, both containing singularities. Despite the fact that servo drives allow 
for real-time adaptions and therefore to control the ram of the tool centre point (TCP), 
the closed-loop control of the TCP still faces unresolved challenges. Therefore, in 
industrial applications, only the drives are controlled in a closed-loop way, and the 
kinematics are open-loop. 

Dulger et al. have drawn a parallel to robotics and have adopted the approach 
of a model-based control [46]. It was possible to demonstrate the feasibility of the 
control qualitatively, but the question of stability at the singularities remains open. In 
the investigation of a master-slave approach, Kirchner et al. have shown an instability 
in the dead centres [104]. This stability problem also occurs in robot kinematics and 
is typically avoided by limiting the joint space [152]. However, the operating point 
of presses is close to the BDC, since the highest possible transmission ratio of the 
force is achieved here. Current robust control methods focus on linear systems, 
and are not able to cope with non-linearities that emerge especially at kinematic 
singularities [94]. To investigate the influence of uncertainty, the press system is 
subdivided into the drive and the kinematics. The drive control has the task of adapting 
the actual drive speed ¢ to the setpoint speed Yer. Since synchronous motors allow an 
almost step-like change of the drive torque, the controlled drive can be approximated 
as a time-invariant first-order transfer function 


PT +P = Gani (6.14) 


with the settling time 7. Since all quantities of the differential equation can be mea- 
sured or derived on the drive side, 7 can be identified by means of the step response 
as described in [92]. The transmission behaviour, however, depends largely on the 
load torque, which is governed by the coupled inertia of the machine, friction and 
the forming force. Since the eccentric angle y changes the transmission ratio of the 
machine and thus the feedback of the mass inertias, r is dependent on p. While 
the smallest mass moment of inertia is applied to the drive in the dead centres, as 
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Fig. 6.12 Uncertainty in a closed-loop control of a servo eccentric press: a effect of uncertain time 
constant 7 on the drive speed dynamics, b kinematic diagram of the 3D Servo Press, ¢ kinematic 
function f(y) with uncertain model parameters causing uncertain dead centres yrpc, YBDC 
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Fig. 6.13 Control loop for a servo press ram control 


the power transmission is theoretically infinite here, the mass moment of inertia is 
greatest between the dead centres. The interval of r can be obtained by identifying 
it in both points. 

The position of the input y and the kinematics of the machine f(y) result in the 
position at the output x, which is the control variable. To derive a control law, the 
differential kinematics, i.e. the Jacobian J 


ð 
i= 5 = Ip): (6.15) 
p 


is required. These can be determined from the nominal geometric values of the rigid 
bodies, but in practice are subject to uncertainty as shown in Fig. 6.12. 

For the press system consisting of drive and kinematics, we seek to design a 
control law C shown in Fig. 6.13 that stabilises the control loop while maximising its 
performance. Performance criteria are the settling time of control deviations e and 
the overshoot, which are represented by the integral of e(t) in a time interval T. To 
investigate the stability, we assume J and C to be approximately constant and thus a 
linear ordinary differential equation can be used. This results in the transfer function 
of the closed control loop in the Laplace s-domain 


x(s) _ CJ 
Xdes(S) u rs? +s+CJ 


G(s) = (6.16) 
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with the complex eigenvalues of the denominator polynomial A1/2 € C. For a stable 
control, the real part of the eigenvalues must be negative R{A} < 0 and to pre- 
vent overshoot, there must be no imaginary part S{A} = 0, resulting in predictable 
requirements. 

For a worst-case design, the maximum possible 7 can be derived as a design 
point. More problematic, however, is the dependence of the transfer function G(s) 
on J, since the sign of C must also change exactly with the sign of J. The common 
approach in robotics is to choose Petr) = J (p)! Ke with the estimated differential 
kinematics J and a constant gain factor K. If the zero crossings of J and J do 
not match, both the stability and the overshoot condition can no longer be fulfilled, 
resulting in very high Yin. The resulting motion again leads to a change of J, back 
into the stable area. Hence, the instability is locally limited in a region around the 
TDC and BDC of p. 

These instable regions are accompanied by undesirable acceleration peaks and 
thus jerk, which negatively affect the durability of bearings and guidance systems. 
While the accuracy of the machine is a process relevant criterion, machine relevant 
criteria, such as jerks, have to be taken into account. The jerks are modelled as 


P = -rl +T Bon (6.17) 
= JSo+2Jö+ JE. (6.18) 


A common approach in robot applications is to lock the dead centres by setting Jo 
zero in a region around yrpc and ygpc. However, since the dead centres of a press are 
arelevant operating point, this approach is not practical for presses. Another approach 
is the damped least-squares, which is based on a regularised inverse Jacobian [32]. 
This causes the inverse Jacobian to become increasingly damped near the singularity. 
While this reduces the effect of the instability and allows to control positions near 
the dead centres, the speed starts to creep, increasing the settling time dramatically. 
The result is getting stuck at the dead centres. Therefore, we investigate both, process 
and machine relevant criteria, in our proposed control. 

As the desired motion of the machine typically is known before, it is possible to 
combine closed-loop control with a feedforward control. The task of motion control 
can then be split into the feedforward path, which generates the control speed for the 
open-loop kinematics ~(t), and the closed-loop control, which only compensates 
for disturbances. Using the generalised regularisation of Tikhonov to find an optimal 
control law 


Peri = argmin, || JG — K (Xaes — x)II3 + ICE — $o)Il3 (6.19) 


allows to include a null motion in the regularisation term, which takes effect when 
approaching the singularities [166]. This null motion can be used to deduce a com- 
bined closed- Toop and open-loop control law C4, which smoothly switches to open- 
loop via do = J! žaes close to the singularities. It corresponds to an additional zero 
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Table 6.4 Simulation results for different control laws using K = 50, y = 0.02 


Type| Control law for Betr L(je|/h) lelmax / h u) in 2B/s? ulX]/ A) in 
1/5? 

Cı |J as 21.9- 1073 | 36.0- 1073 0.00 0.65 

Co | KJ~'e 6.3.1073 | 10.5- 1073 | 5491.84 7.98 

C3 | (Hy) Te 9.6-10-3 | 28.2. 10-3 3.66 6.66 

Ca | 2 +7) 'Se+7¢o) | 62-1073 | 10.8. 10-3 0.04 0.32 


in the transfer function and speeds up the settling time for changes in the setpoint 
Xdes- 

Based on the 1600KN version of the 3D Servo Press presented in Sect. 3.6.3, we 
examine different control approaches in a simulation with uncertain parameters. The 
uncertainty is chosen according to the machine’s actual manufacturing tolerances, 
stiffness, actual sensor errors and noise. 

The performance criteria for the control are the absolute error |e| = |xaes — x|, 
control C;, a closed-loop control with inverse kinematics C2, a closed-loop control 
with regularised inverse kinematics C3 and the combined control C4. 

Because of the singularities, a large dependence on the operating point ¢ is to be 
expected. Therefore a trajectory for all control laws is chosen to cover the complete 
operating area of y € [0, 360°]. To extract one feature for each performance criterion, 
the mean u(-) of the time series is calculated. The variance of the error e is normalised 
to the stroke height h, which is the difference between the dead centres h = xtpc — 
XBDC = 100 mm. 

The simulations show that an open-loop control C; allows to smoothly control the 
machine with little jerks but neglects disturbances and uncertainty leading to a sig- 
nificant normalised position error. While an inverse kinematics control Cz increases 
the accuracy in x, it also leads to higher jerks, mainly at the dead centres. According 
to (6.18), high jerks in the drive have little effect on jerk in the ram X at the dead 
centres where J ~ 0. Therefore, control design Cz leads to high jerks in the drive 
and moderate jerks in the ram. C3 finds a trade-off between accuracy and jerk in Y. 
The only minor reduction in x shows, that the contributing jerks do not occur near 
the dead centres. All closed-loop controls share the drawback that they only react to 
position and errors are not able to anticipate. C4 combines the ability to compensate 
errors while anticipating trajectory changes. The result is a position error comparable 
to C and a drastically smoothed motion whose jerks are comparable to C\. 

A typical approach to master uncertainty in the control of machines is closed- 
loop control. However, especially in servo presses, stability issues occur at their 
dead centres of motion, i.e. at their kinematic singularities. These lead to undesired 
jerks that affect the durability of bearings. Therefore, we presented and evaluated 
open-loop and closed-loop control methods taking into account process accuracy as 
well as machine criteria, i.e. jerk. The investigations have shown that a combination of 
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open-loop and robust closed-loop resolves the conflicting objectives of high process 
accuracy and low machine jerk to the greatest possible extent. 


6.1.8 Mastering Uncertainty in Tapping and Reaming 
by Robust Tools and Processes 


Christian Bolling, Felix GeBner, Eberhard Abele, and Matthias Weigold 


As described in Sect. 4.1.3, machining processes that are used in the production of 
technical systems are generally affected by data uncertainty in form of incertitude, see 
Sect. 2.1. For the manufacturing of the final component geometry, several individual 
processes are linked to form a process chain. Since the output of one process is the 
input for the following process, uncertainty propagates through the process chain, 
as shown in Sect. 3.2. Therefore, regarding the final process of reaming or tapping, 
the uncertainty can have its origin in the preceding process (pre-drill geometry), the 
current process (runout error or synchronisation error), or the combination of the two 
individual process steps (positioning errors). 

For reaming operations, a comparison of different uncertainty factors shows that 
an axis offset between the tool and the bore hole centre has major influence on the 
final geometry [82]. In the simulation of tool displacement in reaming an axis offset 
of 30um shows a resulting tool displacement of 2.8 um. Due to the lack of radial 
guidance of the tool, the beginning of the penetration phase is a decisive point for 
the control of uncertainty. Tool deflection during the first cut leads to an inclination 
of the tool, which, due to the continuously increasing radial tool guidance, remains 
constant over the entire reaming depth [82]. This applies equally to tapping. For both 
processes uncertainty can be mastered by using a robust tool design, or by adapting 
the manufacturing strategies. Within this subsection different approaches based on 
the robust tool design and robust manufacturing strategies are presented for tapping 
and reaming. 


Mastering uncertainty based on the robust tool design 


In earlier investigations, uncertainty factors during reaming were eliminated by 
adjusting the macro geometry of a reaming tool. Schmalz [143] suggests an unequal 
distribution of the cutting edges in order to reduce roundness errors. This adaptation 
became state of the art in the industry. In further investigations on reaming, axis 
offsets are compensated by using tools with a chamfer angle of kr = 90°. By means 
of a simulation model for passive forces during reaming [82], we can show that, for a 
cutting speed of 60 m/min, a chamfer angle of 90° and different variations of cutting 
depths and tooth feeds, the simulated forces are smaller compared to the original 
reaming tool with a smaller chamfer angle. This results in a lower radial force, and 
in turn in lower tool deflection, during the penetration phase. 
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Fig. 6.14 a Original reaming tool geometry and b adapted reaming tool geometry with measured 
radial deviation for cutting speed of 60 m/min, feed of 0.4mm/U and axis offset of 0.06 mm [82] 


Based on further investigations on the influences of geometry elements, we modify 
the original tool geometry (Fig. 6.14a) to an adapted tool geometry (Fig. 6.14b). The 
key modification is a larger Kr of the roughing cutting edge. In addition, two of the 
roughing teeth in the chamfer area are removed, since a lower number of teeth showed 
less deviation of the reaming tool in the simulation, especially if the tool is not yet 
guided through the secondary cutting edges. By applying these modifications, which 
are based on a mechanistic model (see Sect. 4.1.3), we can reduce the measured 
radial deviation by over 60 % [82]. 

The tool shown in Fig. 6.14b is adapted to reduce the effects of axis-offset errors of 
the pre-bore and the reaming tool. Under the assumption of an even drilling surface, an 
inclined pre-drilling has no effect on the radial course. It was therefore not considered 
in the tool design phase. However, if the drilling surface is not even, i.e. if the whole 
component is inclined, a chamfer angle of Kr = 90° has a negative effect due to 
the resulting lateral forces. Considering this effect, we reduce the chamfer angle to 
Kr = 65° and add a pilot reaming process. This leads to better results in terms of 
the lateral tool displacement and reduces the sensitivity of the process concerning 
uneven drilling surfaces [23]. 

When considering positioning inaccuracies in tapping, geometric modelling 
shows that these deviations can lead to an interrupted cut. This results in simul- 
taneous removal of long chips as well as short thin chips, which increases the risk of 
chips jamming between tool and workpiece. We can detect the critical teeth using a 
geometric model [1]. One approach to increase the tool’s robustness and to ensure 
the removal of long chips, even under positioning inaccuracies, is to remove the first 
tooth that potentially leads to an interrupted cut. The adapted tool geometry cuts the 
thread with fewer teeth, reducing the number of chips per flute, while increasing the 
load on the subsequent teeth. Using the simulation tool from [1], we show that for 
axial-offsets of 0.1 mm, a disrupted cut can be prevented by removing the first cutting 
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tooth of the tapping tool. In summary, it can be stated that an adaptation of the tool 
geometry during reaming and tapping can contribute to a reduction in sensitivity to 
certain uncertainty factors. 


Mastering uncertainty based on robust machining strategies 


Adapted machining strategies, characterised by the combination of speed, feed and 
tool path, represent another approach for reducing the effects of uncertainty. As 
the majority of tool deflection arises during the penetration phase, this unsteady 
process phase is the main influencing factor for the reamer’s deflection over the bore 
depth [82]. To reduce the effects of uncertainty during this critical phase, we conduct 
tests with reduced feed rate during the entering phase. The test results show that a 
higher feed rate results in a higher deflection of the reamer. This matches theoretical 
considerations. A reduced feed rate leads to a decrease of forces, which deflect the 
tool in the unsteady phase. However, the application of special entry strategies, such 
as a cubic increase in the feed rate, shows no significant reduction of the medium 
deflection [74]. 

An alternative approach based on the active process control to reduce the effects of 
uncertainty in reaming is to apply suitable machining strategies [28]. The axis-offset 
is determined by the forces during the penetration phase with a sensor-integrated 
reaming tool. After the penetration phase, the reaming process is interrupted and 
the reaming tool is removed from the bore. This procedure can be compared to a 
countersinking process. Based on the integrated sensor data the axial misalignment 
is detected and quantified using a neural network. Thus, we can compensate the axial 
misalignment, before the actual reaming process is conducted. Despite a disrupted cut 
in the entry phase of the reamer, due to the compensation of the axial misalignment 
the countersinking process does not lead to a significant deterioration of the bore [28]. 
The proposed method is therefore suitable for compensating axial displacements and 
thus reaming the bores at the desired location. 

Since the feed rate per revolution is much higher, this approach cannot be easily 
transferred to tapping. However, we can adapt the idea of an upstream countersinking 
process. To obtain threads that are true to gauge, the feed must fit the pitch of the 
thread. If the feed per revolution is smaller than the thread pitch, the tap would drill 
out the existing bore. Using simulations based on [1], we can show that by using an 
M8 tap with a feed of 0.09 mm/rev we can produce a chamfer to a pre-drilled bore 
that has the exact same angle as the chamfer angle of the tapping tool. This pilot 
process step could be used to provide a pilot bore with a defined chamfer that allows 
several teeth to be engaged with the workpiece material at the same time. As a result, 
the lateral forces partly compensate each other, which leads to a lateral support of 
the tap. To show the general feasibility of this approach, we carry out experimental 
investigations in 42CrMo4 steel on a 5-axis machining centre “Grob G350”. The 
pilot process is realised with an M8 machine tap, a feed of 0.09 mm/rev and a cutting 
speed of 60 m/min. The drilling depth of the countersinking process is varied between 
1.25 and 3.75 mm, which equals 1 to 3 times the pitch of the tap. We carry out the 
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Fig. 6.15 Resulting geometry of a the countersinking process and b the subsequent tapping process 
with a pilot depth of 2.5mm 
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Fig. 6.16 Simulated and experimental results of the countersinking process in tapping for pilot 
depths of a 0mm, b 1.25mm, ce 2.5mm and d 3.75 mm 


subsequent tapping process using the same tool with a feed of 1.25 mm/rev and a 
cutting speed of 15 m/min. The resulting geometry is shown in Fig. 6.15. This is due 
to the removed material causing an air cut at the entrance to the bore. Furthermore, 
the effect of multiple teeth engaging with the material at the same time is visualised 
by the steps of the calculated chip cross-section A of each land of the tapping tool. 
With an increasing number of teeth being engaged simultaneously, the number of 
visible steps declines until the stationary process phase, when all teeth are engaged, 
is reached. For the pilot depth of 3.75 mm, which equals the chamfer length of the 
used tool, all of the chamfered teeth are engaged with the material at the same time. 

By increasing the pilot depth, the starting time of the first material engagement is 
shifted backwards (see Fig. 6.16). 

Since the depth of the pilot process affects the inner diameter of the thread in 
the penetration phase, a large pilot depth could lead to negative influences on the 
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load-bearing strength of the thread. With a pilot depth of 2.5mm, which equals two 
teeth of the tapping tool, the teeth with the biggest chip cross-section are already 
engaged simultaneously. However, the influence on the thread geometry is much 
smaller than for a pilot depth of 3.75 mm (see Fig.6.16). Thus, the pilot depth of 
2.5mm can be seen as a good compromise between the conflicting goals of keeping 
the load-bearing strength of the thread and improving the process robustness by a 
simultaneous engagement of the teeth. 


Conclusion 


In this section, we demonstrate a number of approaches to master uncertainty in ream- 
ing and tapping. The approaches are, on the one hand, robust tool geometry design, 
and on the other hand, robust process design, e.g. with additional pre-machining 
steps. The approach of using the simultaneous engagement of all teeth of the tapping 
tool can be used to transfer findings from reaming to tapping by largely compensat- 
ing the resulting radial forces during the penetration phase. This demonstrates the 
potential transfer of the existing knowledge on reaming to tapping. The fact that both 
processes are characterised by a penetration phase that is critical to the susceptibility 
to disturbance variables shows that there are parallels that should be pursued in future 
research activities. 


6.2 Flexibility 
Peter Groche and Maximilian Knoll 


In addition to the strategies already presented for mastering uncertainty, a strategy for 
mastering uncertainty by means of increasing machine flexibility is presented below. 
In Sect. 3.5 we defined: A flexible system is characterised by the fact that it fulfils 
i = 1,..., N predefined functions g; with accepted functional quality ög;. Flexible 
manufacturing systems are advantageous with respect to mastering uncertainty in all 
phases of a product life cycle (cf. Sect. 1.2). An example of flexibility in product 
design is given in Sect. 3.5. In the following, we focus on the production phase. 

The planning and selection of manufacturing systems are associated with uncer- 
tainty. Uncertainty may occur if a future event for the manufacturing system con- 
sidered is not known, or if future events are probabilistic. Manufacturers have to 
expect four variants of uncertainty which are the market acceptance of product types, 
length of product life cycles, specific product properties and aggregated product 
demand [66]. 

One approach to counter uncertainty in the area of production is to increase the 
flexibility of the used manufacturing systems and processes. According to [153] 
flexibility is divided into time and range. A possible solution, which copes with 
the uncertainty is called “bank flexibility”, which is a financial buffer built up for 
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future needs. Investments financed from this can, for example, absorb unforeseen 
changes in market conditions. Furthermore, investments to cope with uncertainty 
can be achieved by new flexible manufacturing systems. One manufacturing system 
is considered more flexible than another, if it can handle a wider range of products, 
processes and tools. [66]. 


6.2.1 Total Flexibility in Forming Technology 
Peter Groche and Maximilian Knoll 


Total flexibility can be further divided into four types, namely equipment flexibility, 
product flexibility, process flexibility and demand flexibility [154]. Equipment flex- 
ibility is defined as the ability of a system to integrate new products and variants of 
existing products. Product flexibility is the ability of a production system to adapt 
to the changing product spectrum. Process flexibility characterises the adaptability 
of the system to changes in parts processing, e.g. caused by changes in technol- 
ogy. Demand flexibility describes the ability of a production system to respond to 
changes in the demand of the market. Flexible manufacturing systems can cope with 
occurring fluctuations. Based on the four types of flexibility, different concepts for 
flexible assembly and cutting machines have already been intensively investigated in 
the past. However, uncertainty also influences the future market value of a specific 
forming machine, so the focus will be on forming machines [72]. 

Today’s forming machines are used for large series production with fixed selected 
forming processes, or for small series production with predetermined special tool 
movements. Consequently, the available flexibility in terms of adaptation to changing 
market conditions is limited [144]. The implementation of servo technology (see 
Sect. 3.6.3) is a first step towards increased flexibility by an extended process control 
of forming processes [73]. 

Forming machines and the associated processes differ in the number and type of 
degrees of freedom (DoF) in their driven movements. A DoF is defined as an indepen- 
dent way of moving a body. A three-dimensional space thus has three translational 
and three rotational degrees of freedom. This means that an input with one DoF can 
provide a maximum of one independent degree of process freedom at the output. In 
the following discussion, a forming system is considered, which is described only 
by the drives made available in the machine and thus the DoF. 

The influence of the additional degrees of freedom on the flexibility types is anal- 
ysed using continuous and discontinuous forming processes, see Fig. 6.17. It becomes 
obvious that with increasing degrees of freedom the flexibility of tool, product and 
process flexibility increases. However, due to longer tool paths, the demand flexi- 
bility decreases with the increasing number of degrees of freedom. Especially large 
series production is based on forming technologies, which are characterised by a one 
degree of freedom movement. This type of movement leads to low tool-to-workpiece 
contact times and thus high productivity. 
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Fig. 6.17 Classification of continuous and discontinuous forming processes by DoF, in accordance 
with [72] 


Considering forming machines or processes with one rotational or translational 
DoF, such as rolling or deep drawing, the result is a low equipment flexibility. This 
results from the fact that the shape of the component cross section to be achieved 
is given by the shape of tools (Fig. 6.17). Due to the rigid tools, machines and pro- 
cesses with only one DoF in their movements possess a smaller product flexibility 
compared to processes with higher degrees of freedom. Additionally, they require 
more capacity for tool production and setup. The process flexibility is also low com- 
pared to processes with higher degrees of freedom, because of the limited usability 
of existing tools dedicated to previously executed production routes. In contrast, the 
demand flexibility of processes with few degrees of freedom is high since even a 
large number of parts can be produced on short notice. A control of process fluctua- 
tions is only possible to a limited extent, which is why the product quality is strongly 
dependent on the fluctuations in the semi-finished product. Conventional mechanical 
presses as well as servo presses allow translatory movements. Servo presses allow 
freely programmable speed-time sequences, which contribute to improved material 
flow, shorter setup times or increased product quality [73]. 

Forming processes with two degrees of freedom are, for example, flexible rolling 
or orbital forming. These processes not only allow the production of new products or 
variants by the development of new tools, they also allow the independent controllable 
speed-time curves for the respective DoF to react to the uncertainty of semi-finished 
product variations. By increasing the degrees of freedom, the tool contact time is 
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increased in comparison to a movement with only one DoF. At the same time, the 
complexity of the control system is increased, which reduces the flexibility with 
respect to demand [73]. 

The increase to three DoF in the tool movement provides the so far conventionally 
established highest flexibility in machine, product and process design. By using three 
degrees of freedom, complex component operations can be produced in continuous 
and discontinuous processes. These include the processes of flexible roll forming 
and the Single Point Incremental Forming process. The Single Point Incremental 
Forming process was used for the production of spring elements in Sect. 5.4.8. These 
processes offer the possibility of producing a variety of three-dimensional geometries 
with a fixed tool geometry. Specific workpiece geometries are achieved by specific 
tool movements. Due to the flexibility of the tool, the set-up time is reduced to a 
minimum. The increased control effort and the associated increased manufacturing 
time reduce the flexibility of demand. Thus, the ability to react to increasing sales 
figures is significantly reduced [73]. 

Processes with one DoF offer the highest degree of demand flexibility, especially 
when considering the costs related to the batch size and the setup and maintenance 
effort. In the case of a smaller batch size, these production processes are not eco- 
nomically feasible due to their high fixed costs. Forming operations with two or 
three DoFs are in most cases designed for more complex products so that a smaller 
batch size of workpieces can be achieved. An increase in demand can usually only 
be achieved by using additional machines. The machines used for this purpose are 
mostly designed for special operations and are only capable for series production in 
a very limited way. Based on these findings, a forming machine has so far shown 
either high product, process and equipment flexibility or high productivity [73]. 

Frequently, used conventional presses provide a pure translatory relative move- 
ment of tool and workpiece. The investigation of forming processes shows that form- 
ing machines with flexible tool movements can have economic disadvantages in pro- 
duction technology (Sect. 3.6.3). In order to achieve the high productivity necessary 
for mass products in addition to complex products, the drive system of a forming 
machine should be usable for simple linear movements without reducing the produc- 
tion speed. This makes it possible to combine a flexible forming machine with high 
batch sizes. To realise a press with translatory stroke motion with additional degrees 
of freedom, three drive points of a plane are necessary. These three drive points can 
be driven by three axis-parallel translatory drives, see 3D Servo Press Sect. 3.6.3. By 
the simultaneous linear displacement of the three points, a translatory movement is 
realised similar to conventional presses. In contrast, the asymmetrical control of the 
three drive points results in a tilting movement of the point plane. The Tool Centre 
Point (TCP), which is located in the centre of the three drive points, shifts exclusively 
in the vertical plane, assuming small tilting angles. Based on these considerations, 
they can be transferred to a new press type [73]. 

In the following, a short description of the design is given. For the movement of 
the ram, a servo motor and a crank mechanism are used at each of the three drive 
points of the plane. These drives have a good controllability, and high stroke rates 
can be realised with them. Furthermore, the drives can be controlled independently 
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of each other, so that the translation and tilting movements of the TCP can be con- 
trolled freely. The kinematics of the 3D Servo Press enables processes with one DoF 
of the ram such as punching, embossing and deep drawing. Furthermore, combined 
flexibly controlled processes, which are presented in [14, 70], are possible. Due to 
the additional degrees of freedom, the multi-technology machine can be used to 
investigate new and existing processes to extend existing process limits. The addi- 
tional degrees of freedom in orbital forming processes offer the possibility of using 
the process strategy for a targeted control of product properties independently of the 
machine or tool kinematics (Fig. 6.18) [31]. Furthermore, Single Point Incremental 
Forming can be investigated for higher sheet thicknesses and high-strength steels. 
Previous investigations on these processes are limited to applications on special or 
milling machines. In comparison, the use of the 3D Servo Press offers the potential 
to explore new process limits and process control strategies. 

Production technologies are confronted with uncertainty based on unknown mate- 
rial, product and demand influences. One way to master the uncertainty is to increase 
the flexibility of manufacturing systems. This can be done as described by increasing 
the degrees of freedom in machines and processes. Flexible manufacturing machines 
have advantages in comparison to conventional manufacturing systems, especially 
in uncertain demand scenarios. It becomes clear that the 3D Servo Press with its 
implemented control system is able to achieve a consistent product quality through 
different adopted process parameters. The total flexibility in forming technology 
shows a promising approach to cope with different types of uncertainty. 
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6.3 Resilience of Technical Systems 


Marc E. Pfetsch 


Resilience is a topic that is currently in the focus of many different research areas: 
psychology, sociology, safety-critical infrastructure, and many others. In this section, 
we concentrate on the resilience of technical systems. Thus, we define the follow- 
ing understanding of resilient technical systems in mechanical engineering, cf. [7, 
p. 189]: 


A resilient technical system guarantees a predetermined minimum of functional performance 
even in the event of disturbances and failures of system components, and a subsequent 
possibility of recovering. 


Disturbances and/or failures can lead to a loss of functionality in a technical system; 
in particular, the disturbances or failures can be severe and might not be anticipated. 
The resulting ignorance can then be mastered by a technical system that is resilient. 
For an additional motivation and discussion of resilience see Sect. 3.5. 

This section investigates resilience as a strategy to master uncertainty in its many 
facets: from a structural discussion of resilience characteristics, over methods to 
guarantee resilience, to an experimental evaluation for specific technical systems. The 
discussion also includes and combines contributions from mathematical optimisation 
and different areas of mechanical engineering. 

Section 6.3.1 starts with a discussion of the definition and the differences to robust- 
ness as presented in Sect. 6.1 and introduced in Sect. 3.5. Moreover, it presents sev- 
eral metrics to quantify resilience. Section 6.3.2 covers so-called adaptive resilience 
and the difference to flexibility. It characterises different methods to obtain adap- 
tivity. Sect. 6.3.3 describes the role of human interaction on and in resilient sys- 
tems. In Sect. 6.3.4, mathematical optimisation methods to design resilient trusses 
are presented. The effect of different buffering capacities and its influence on the 
performance range are discussed. Sect. 6.3.5 continues with optimisation methods 
for designing water supply networks. An adaptive method for computing networks 
with different buffering capacities is presented and evaluated. Section 6.3.6 consid- 
ers drop tests using a Fluid Dynamic Vibration Absorber. It experimentally demon- 
strates the increased resilience of a system incorporating this technology. The topic 
of Sect. 6.3.7 is the interplay of the production and usage phase of a hydraulic actu- 
ator. Experiments evaluate the effect of production disturbances in the usage phase. 
Finally, Sect. 6.3.8 considers a real resilient fluid system test rig. The incorporation 
of algorithmic models for learning and the applicability of the resilience triangle are 
evaluated experimentally. 

Designing a completely resilient technical system requires high effort and costs. 
Nevertheless, the virtual examples in Sects. 6.3.4 and 6.3.5 demonstrate how such 
systems can be approached and allow for a quantification of resilience costs. More- 
over, the basic research example in Sect. 6.3.8 shows how the control of a technical 
system can be adapted to achieve a higher resilience. This is complemented by the 
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other sections, which focus on the resilient design process, resilience metrics and 
human factors. 


6.3.1 Resilience as a Concept to Master Uncertainty 
Lena C. Altherr and Philipp Leise 


The concept of resilience has found its way into different disciplines where it is 
commonly used to describe the ability of an individual or a system to withstand and 
adapt to changes in its environment, cf. [55, 97, 148, 163]. In order to address the 
resilience of technical systems, a tailored definition and understanding, as well as 
suitable metrics to quantify resilience are required. In this subsection, we show first 
results on adapting the concept of resilience to technical systems, and address the 
following questions: (i) How to differentiate between robustness and resilience? (ii) 
How to quantify the resilience of a technical system? 


What is resilience of technical systems? how is it possible to differentiate 
between robustness and resilience? 


Prior to engineering, resilience was introduced in the domain of human factors. 
Within this domain, special attention is paid to resilience for the design of socio- 
technical systems and safety management. According to Hollnagel, “a system is 
resilient if it can adjust its functioning prior to, during, or following events (changes, 
disturbances, and opportunities), and thereby sustain the required operations under 
both expected and unexpected conditions” [91]. Given this understanding, resilience 
of a technical system can be seen as a concept to master the unexpected and thus 
uncertainty. 

While the human factor research community focuses on analysing the socio- 
technical interaction between humans and technology (cf. Sect. 6.3.3), in the follow- 
ing subsections of Sect. 6.3, we focus on transferring the idea of resilience to technical 
systems. We explicitly consider each product life phase as introduced in Sect. 3.1 and 
show resilience principles and approaches that can be transferred to a broad range 
of systems, as for instance the example reference systems introduced in Sect. 3.6. In 
the context of product development, resilience—as compared to robustness—can be 
regarded as a paradigm shift. According to Taguchi, [159-161], robust design refers 
to functional characteristics of a system perceived by the user as being unaffected 
by disturbances and failures. Robust Design may be achieved by mathematical opti- 
misation methods dealing with uncertainty, cf. [69]. Robust optimisation allows to 
optimise technical systems regarding user-specific objectives, while guaranteeing 
robustness of the design against uncertain input parameters, e.g. feasibility even in 
case of uncertain load parameters. The generated robust solutions fulfil their purpose 
not only at the design point, but also in a surrounding neighbourhood, the so-called 
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uncertainty set, cf. [15]. For further details and examples of robust design and robust 
optimisation see Sects. 6.1.1—-6.1.4. 

New approaches to design products considering not only robustness, but also 
resilience, allow us to master ignorance or nescience (see Chap. 2 and Sect. 3.5): 
Compared to a robust system, a resilient system is not only able to withstand expected 
disturbances and failures, but is also able to handle unexpected disturbances and fail- 
ures which were not explicitly taken into account during the design phase. Robust 
systems guarantee performance for a known range of uncertain parameters (the uncer- 
tainty set), however, once outside this range, they might break down completely. Yet, 
resilient systems are characterised not only by their ability to withstand specific 
disturbances and/or failures, but are also “safe-to-fail” [2], yielding a minimum per- 
formance even in case of a failure and a subsequent ability to recover. 

Thus, we use the definition already mentioned in Sect. 6.3: “A resilient technical 
system guarantees a predetermined minimum of functional performance even in the 
event of disturbances and failures of system components, and a subsequent possibility 
of recovering.”, cf. [7, p. 189]. 

In socio-technical or technical systems, the ability to recover is connected to 
maintenance measures, e.g. replacement of damaged components and/or capacity 
adaptations. In some rare cases, the technical system itself is able to recover to 
some extent, as shown for example by Bongard and Lipson in [27]. In this example, 
they describe an intelligent starfish-shaped robot that recovers autonomously from 
removing parts of its legs. 

Given the ability of ideally resilient systems to be “safe-to-fail” [2] and to recover, 
the next logical step is to characterise resilient technical systems and to investigate 
how it is possible to specifically design the resilience. 

One approach to master uncertainty by building resilient systems is given by Holl- 
nagel [87-89]. Hollnagel distinguishes four abilities/functions (monitoring, respond- 
ing, learning, anticipating) that resilient systems should contain. They are shown in 
a systematic way in Fig.6.19. We will address the transfer of this approach to the 
mechanical engineering domain in more detail in Sect. 6.3.8. 


How is the resilience of technical systems quantified? 


A first prerequisite to design the resilience properties of a system is to be able to 
assess them. Different qualitative and quantitative concepts for measuring resilience 
are proposed in the literature. For an overview see, e.g. [54]. While some metrics in the 
literature are either described in very general terms, or are not applied to technical 
systems, others are very specific to the system under consideration. For instance, 
for water distribution systems alone, more than 20 tailored resilience metrics were 
proposed by different authors [148]. Since many of the critical infrastructures that are 
examined with regard to their resilience, such as roads or supply systems for energy 
or water, are network-like, graphs can be used to describe them. Thus, also graph 
theoretical metrics (e.g. average path length, link density, central point dominance 
or k-shortest path length) have been proposed to assess resilience, see e.g. [85, 127]. 
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Fig. 6.19 Four abilities/ 
functions to derive a resilient 
system, based on [83, 87] 


Regarding general technical systems that are not necessarily network-like, a cat- 
alogue of design principles is proposed in [97], and the first author states that “the 
measurability of resilience should be a top priority topic for further research” [98, 
p. 35]. Since we characterise a resilient system by the fact that it can sustain the 
required operations even in the event of disturbances and failures, we use its per- 
formance under varying external and internal influencing factors i as the basis for 
assessing its resilience. Based on this understanding, we discuss a collection of differ- 
ent metrics, which we exemplify qualitatively. While there may be multiple external 
and internal influencing factors, which may influence the performance, we choose 
an univariate depiction for reasons of clarity. 

In [7] we defined the performance range p of a technical system. It describes 
the subset of influencing factors for which the system is able to maintain a prede- 
fined minimum performance fmin. Figure 6.20a depicts the performance range for an 
univariate function. Mathematically, the performance range can be expressed by the 
so-called ‘superlevel set’, 


LẸ ( fmin) = fx € X| f(x) = Frain hs 


Here, f : X — Risthe system’s performance for varying arbitrary influencing fac- 
tors x € X, cf. [7, p. 189]. Based on the performance range, several metrics can be 
introduced, e.g. the area under the curve above fmin, or the performance range times 
a problem-specific weighting factor that gets smaller with a growing distance from 
the design point. As a general metric, we propose in [7] the radius of performance 
rp, cf. Fig. 6.20a. It measures the minimum distance between the design point and 
a realisation of an influencing factor for which the minimum performance can no 
longer be maintained. 

In addition to the radius of performance, also the margin m can be used to assess 
the resilience of a technical system. It describes “how closely or how precarious 
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Fig. 6.20 Resilience metrics: a performance range p and radius of performance rp, b margin m 
and gracefulness g [7] 


the system is currently operating relative to one or another kind of performance 
boundary”, cf. [175, p. 23]. In [7], we proposed to quantify the margin by measuring 
the distance between the performance at the design point and the required minimum 
performance, see Fig. 6.20b for an illustration. Thus, it can be calculated by 


m = f(d) —. min, 


where m is the margin, f (d) is the performance of the system at the design point d, 
and fmin is the predefined minimum required performance of the system. 

Resilient systems have been characterised to be safe-to-fail, cf. [2]. For this, it is 
important “how a system behaves near a boundary— whether the system gracefully 
degrades as stress/pressure increase or collapses quickly when pressure exceeds 
adaptive capacity.”, cf. [175, p. 23]. As such, resilience includes graceful degra- 
dation [68], once the system reaches its performance limit. In [7], we defined the 
gracefulness g of a system mathematically, being the directional derivative of the 
performance f in the direction of a given influencing factor or a vector of multiple 
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influencing factors, cf. Fig. 6.20b. If the performance is non-differentiable, the limit 
from the direction of the design point may be used if it exists. 

Another property of resilient systems is their buffering capacity. This term was 
first described in [175, p. 23] by Woods as “the size or kinds of disruptions the sys- 
tem can absorb or adapt to without a fundamental breakdown in performance or in 
the system’s structure”. In [7] we have defined buffering capacity as a quantitative 
measure of how much structural change the system can withstand while still fulfill- 
ing the predefined minimum performance. Depending on the context, the buffering 
capacity can assume continuous or discrete values. In the case of discrete values, the 
buffering capacity describes the number k of failed system components at which the 
minimum performance can still be maintained. In this case, the system may also be 
called k-resilient, cf. [10]. 

It is important to note that for assessing a system’s buffering capacity, the worst- 
case failure is always taken into account, i.e. the combinations of k = 1, 2,3,... 
component failures, which are the most critical for the overall system. This is illus- 
trated in Fig.6.21 for k = 1 and for a system consisting of three components A, B 
and C. The worst-case performance f(x) corresponds to the minimal performance 
over the set of all scenarios with up to k arbitrary failed components. Thus, a system 
has a buffering capacity of k (or is k-resilient) if, within an uncertainty set U of the 
influencing factors, its worst-case performance f;(x) reaches at least the predefined 
minimum performance fmin, 1.€. 


f(x) > fmin Yx € U, 


where U is the uncertainty set. The smallest possible uncertainty set corresponds to 
the design point d. 

While the above-mentioned metrics can be used to measure static characteristics 
of resilient systems, also its dynamic behaviour should be taken into account. The 
metric rapidity r, was proposed for measuring the system’s capacity to recover its 
functionality in a timely way, [165]. For this purpose, the time period between the 
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Fig. 6.21 Worst-case functional performance f of a system with failure of one of its components 
A, B or C, [7] 
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Fig. 6.22 Metrics for measuring the system’s ability to recover: rapidity and resilience triangle R, 
cf. [7, 165] 


occurrence of the disturbance and/or failure and the restoration of functionality is 
measured, 1.€. fpost — Ipre, Cf. Fig. 6.22. 

Another measure for the dynamic aspects of resilience, also proposed in [165], 
is the so-called resilience triangle. Here, the total losses (e.g. in utility, revenue or 
performance) are measured until the system is recovered. These losses can either be 
approximated by a triangle, or calculated by 


R= ia max{0, Sore — f (t)} dt, 


pre 


see, e.g. [163]. The triangle approximation is shown in Fig. 6.22 with hatched lines, 
while R is shown in grey. 

While the presented metrics are intended to be suitable for the resilience assess- 
ment of general technical systems, their application in practical usage has to be 
proven. The next subsections show the application of the proposed metrics to prac- 
tical engineering examples. 


6.3.2 Mastering Uncertainty in Engineering Design 
by Adaptive Resilience 


Fiona Schulte, Hermann Kloberdanz, and Eckhard Kirchner 


We consider resilient system properties as an extension of robustness to handle uncer- 
tainty caused by nescience, see Sects. 2.3 and 6.3.1. A central aspect of resilient 
system behaviour is the adaptivity of the system. A purposive adaption is required 
to make the system continuously usable under changed internal or external system 
conditions, as introduced in Sect. 6.3.1. The condition changes also include disrup- 
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tive changes, which can be external disturbances or internal component failures, that 
could severely damage the system. The resilient system shall cope with those changes 
using its resilient properties, cf. [142, p. 81]; [175, p. 21]. 

Resilience in engineering design implies a paradigm shift compared to robust 
design. To facilitate its realisation it is useful to support designers with a design 
methodology for addressing uncertainty using resilience during the product devel- 
opment process, see Sects. 1.2 and 3.5. In particular, systematic planning and design 
of the adaptivity for certain unforeseen system disruptions is of importance when 
developing resilient systems. Therefore, we present models and approaches in this 
Section. 


Adaptivity 


Adaptivity in the resilience context is defined as the system’s ability to adjust to 
changing purposes or conditions in a suitable way. The desired adjustment aims 
at approaching a predetermined behaviour under the new conditions and indicates 
that the adaption of the system allows the maintenance of elementary system func- 
tionalities instead of a system failure and possible consequential damages, cf. [98, 
p. 107]; [96, p. 7]. 

Adaptivity in load-bearing systems can either be realised autonomously or exter- 
nally induced as distinguished in Fig.6.23. Autonomous or internal adaptivity 
includes all adjustments that happen within the system simply triggered by a change 
of conditions. Externally induced adaptivity usually requires a human operator or an 
additional external system that influences the system towards the desired adaption, 
cf. [142, p. 81]; [90, p. 224 et seq.]. 

The kinds of adaptions vary in the way of realisation and timing. Autonomous 
adaptions normally apply quickly because they are triggered by the disruption itself 
or correlating signals within the system, though in many cases the measures are only 
effective short-term. They necessitate the system’s ability to improvise. This can, e.g., 
be realised by physically or functionally redundant structures [142, p. 81]. A prompt 


Fig. 6.23 Adaptivity in adaptivity 
resilient systems is divided (adjustment to changed situation/environment) 
into autonomous and 


externally induced reactions internal/ 


external 
autonomous 


capacity to adapt adaptability 


adaption 
(actual adjustment) 
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reaction realised by autonomous adaptivity is often required due to sudden rapid 
disruptions. However, the disruptions can last for a long term, which makes addi- 
tional measures necessary, if the autonomous measure is only applicable short-term. 
In many cases, the additional measures are externally induced. Externally induced 
adaptions can usually not be applied promptly, as a human operator’s response time 
is interjacent. In return, externally induced measures are effective for a longer period 
of time. Thus a combination of a prompt autonomous and a long-term externally 
induced adaptivity is recommendable. Externally induced adaptivity relies on the 
ability to convert, i.e. a replacement of the damaged subsystem by an identical one. 
Alternatively, the subsystem can be exchanged or even extended. We define the term 
exchange as the incorporation of a partly improved subsystem. Extension describes 
a significant improvement of the subsystem and requires an innovative capability, 
which usually implies the contribution of a human operator’s development work, 
cf. [142, p. 81]. 

An adaption is realised by implementing the resilience functions monitoring, 
responding, learning and anticipating, as introduced in Sect. 6.3.1 and evaluated in 
Sect. 6.3.8, cf. [90, p. 227]. Depending on the system’s complexity and the necessity 
of resilient functionalities, only one or several of the functions can be combined. The 
central resilience function is ‘responding’ because it describes the execution of the 
purposeful system adaption instead of an arbitrary reaction of the system. This means 
responding is always required in case a disruption, which is either an external dis- 
turbance or an internal failure, occurs. More sophisticated systems additionally use 
the resilience functions monitoring and anticipating. Monitoring means that param- 
eters that have an influence on the system or quantities correlating to the influencing 
factors are measured. The anticipating function then describes the interpretation of 
the monitored data, which allows the system to foresee upcoming or potential dis- 
ruptions and thus to react and apply measures before the disruption actually occurs, 
while responding only describes a reaction towards a disruption, cf. [90, p. 224 et 
seq.]; [175, p. 121 et seq.]. 

The resilience function learning exceeds anticipating by interpreting the data not 
only according to upcoming disruptions but also regarding the success or failure of 
the applied measure. Depending on the measure’s result, a learning system is able to 
adjust the reaction for the case of a repeating or similar disruption. The implementa- 
tion of learning relies on an artificial intelligence (AI) or a human operator included 
within the system as contemplated in Sect. 6.3.3. The AI or human operator is able to 
take on the processing of the monitored data regarding the measure and its particular 
success or failure, respectively. As an AI or a human operator cannot be presumed 
in most technical systems, especially technical subsystems, the realisation of learn- 
ing in technical systems is rather an outlook for further development. Nonetheless 
it is beneficial to design resilient subsystems, because such subsystems support the 
realisation of resilient properties in the superordinate system, cf. [90, p. 224 et seq.]. 
In the following, we focus on the resilience functions monitoring, responding and 
anticipating. 
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The resilience application model 


We developed the resilience application model to describe the interdependencies 
between the resilience characteristics and behaviour, as well as the disruption and 
the signal, respectively. The resilience application model is based on the defini- 
tion of resilience for load-bearing systems, in particular, and on the definition of 
metrics regarding the system resilience characteristics and behaviour (Sect. 6.3.1), 
cf. [7, p. 189 et seq.]. The application model considers the resilience characteristics 
and behaviour as supplied before in Sect.6.3.1 and adds the consideration of the 
disruption and a correlating signal progression. According to Jackson [96, p. 6] con- 
sidering the disruption is of high importance for the realisation of resilience and the 
four resilience functions. In addition, the correlating signal is especially important for 
the functions monitoring, anticipating and learning, cf. [146, p. 1406 et seq.]; [145, 
p. 3 et seq.]. 

The resilience application model offers support for analysis and synthesis during 
the development process of resilient load-bearing systems. The analysis approach 
starts with the identification of the disruption and the determination of its temporal 
progression shown in Fig. 6.24c. If monitoring and anticipating are used within the 
system, the identification of a correlating signal, such as in Fig. 6.24d, and its pro- 
gression are crucial, as monitoring is responsible for gathering data of a correlating 
signal, and anticipating relies on the gathered information. With knowledge of the 
resilience characteristics as shown in Fig. 6.24a, which provide the interrelation of the 
functional performance and different influencing factors, the impact of a disruption 
can be determined, as also described in Sect. 6.3.1. Based on the disruption, respec- 
tively signal progression and the resilience characteristics, the expected dynamic 
resilience behaviour can be determined as in Fig.6.24b (see Sect. 6.3.1). During 
the synthesis, the aspired system properties can be described using the resilience 
application model. First, the aspired resilient behaviour is defined. Afterwards the 
required resilience characteristics for realising the behaviour can be deduced, e.g., 
the value of the required minimum performance or the system’s gracefulness. Fur- 
thermore, the necessity of monitoring the disrupted influencing factor or correlating 
signals for realising the required characteristics can be examined, cf. [146, p. 1406 
et seq.]; [145]. 

For the depiction in Fig.6.24 we chose the example of a system that is disrupted 
and applies a booster, which increases the possible performance of the system for a 
certain time. It shows how the four graphs of the resilience application model could 
look like for a particular case. A boosted system could, e.g., be a car using snow 
chains in case of the disruption of sudden black ice represented by a jump in the 
disruption graph. Figure 6.24 shows the exemplary progressions of the system in 
the resilience application model. Without snow chains the car is not able to deliver 
the required performance. Hence a measure is required to restore the functional 
performance to the minimum level fmin. The booster is represented by the upper 
grey graph in comparison to a system not applying a measure depicted in black. 
Applying snow chains increases the traction performance of the car on black ice. As 
soon as the disruption of black ice disappears, the snow chains can be removed and 
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Fig. 6.24 Resilience application model with exemplary progressions for a system applying a booster 
a resilience characteristics, b resilience behaviour, e disruption progression, d signal progression 
following [146, p. 1407] 


the car resumes its functional performance without additional measure, as shown 
by the upper grey curve which reaches its original value again, cf. [146, p. 1410 et 
seq.]. In case of the snow chains, it becomes apparent that this booster functionality 
is only useful during the disturbance phase because the snow chains increase traction 
and therefore allow to maintain the system’s essential ability to drive. However, they 
reduce the achievable velocity significantly, which is not desired under undisturbed 
conditions. Beyond conflicts of several desired system properties, it often also saves 
resources to apply the booster only for a certain period of time, like in case of 
emergency generators with limited energy capacity. 

The central aspect for realising resilient behaviour is that a system is able to pur- 
posively adapt to new conditions. The purposive adaption is realised implementing 
the four resilience functions, while responding is the most important resilience func- 
tion, as it describes the application of the adaption. The interrelations of the resilience 
properties, which comprise the resilience characteristics and the resilience behaviour, 
as well as the disruption progression and possible correlating signals are describable 
using the resilience application model. The model is also able to describe a desired 
behaviour and the complementing resilience characteristics for the system synthesis. 
The desired behaviour can be formulated as an ideal system and then be refined to an 
actual technical solution. The methodological approach is not fully composed yet, 
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but we consider the presented models and methods as a useful support for making 
resilience amenable for designers that are unfamiliar with the approach. 


6.3.3 Human Factors in Resilient Socio-Technical Systems 
Pia Niessen 


The mastering of uncertainty plays an important role in complex systems, which 
can be divided into technical and socio-technical systems. Technical systems only 
include technical components and their interaction. In socio-technical systems, the 
human being and the technical components are taken into account. The effects of 
the interaction of humans and technology play a decisive role in the analysis of 
socio-technical systems. For the research on resilience it is relevant to integrate 
aspects of the interaction between humans and technology in order to implement 
certain functions that can lead to resilience. An extension of the technical system to a 
socio-technical system thus also enables the consideration of important influencing 
variables on the resilience and performance of a system. In socio-technical systems 
humans can be seen as an unpredictable source of both reliability and errors, which 
has an impact on the resilience of the system. The identification of different com- 
ponents of resilience is complex, especially the question, to what extent humans are 
involved as an actor in a resilient system. Most of the research in this field is taking 
place in the area of Resilience Engineering. The resilience of the systems here, is 
linked to safety management, faced with known or unknown situations. The context 
of the studies are sectors where humans and machines work together in critical sit- 
uations, for example in aviation, healthcare, chemical and petrochemical industry, 
nuclear power plants, and railways [138]. In the following section of this overview, 
the possibility to integrate the human into a resilient system is outlined. 


Modelling human behaviour in socio-technical systems 


To classify the human in a socio-technical system, biological, cognitive, emotional, 
motivational or dispositional aspects can be considered. The consequences of these 
aspects are observable actions or decisions. In the case of modelling, it is therefore 
relevant to determine which part of the human being is to be investigated. The anal- 
ysis of behaviour leads to behaviour models while the analysis of decisions leads to 
decision-making models. Behavioural models explain human behaviour as an out- 
come and model the upstream processes, for example cognitions. They can explain 
how a particular disposition leads to a particular behaviour of humans. In a socio- 
technical system, these variables have an influence on the entire system output. By 
manipulating the upstream processes, a certain human behaviour can be simulated 
and promoted. Examples for this can be found in numerous disciplines analysing 
and predicting behaviour in social systems [3]. A further class of human models are 
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Fig. 6.25 Example for a decision-making model in a safety-critical context with an unexpected 
system diagnosis and the following decision possibilities 


decision-making models. These can be used as process models to simulate resilience 
in human decisions [117]. Thereby criteria are defined, for example redundancy, and 
afterwards such a criterion can be applied to the human decision, understood as a 
process chain. This modelling is mainly used in safety-critical contexts. Figure 6.25 
depicts an example of a decision-making model which shows the possibilities for the 
development of resilience triggered by human beings. Both types of models can be 
tested in various ways, for example with the fuzzy logic [40]. 


Application of resilience metrics in a socio-technical system 


In order to measure resilience, metrics are established in Sect. 6.3.1. These metrics 
can be equally applied to the socio-technical system, depending on the type of the 
human modelling. In his Functional Resonance Analysis Method (FRAM), Holl- 
nagel [89] outlines the application of four resilience functions in an organisational 
context. All four functions (learning, responding, anticipating, monitoring) are seen 
as cross-sectional claims. This means that people are also required to learn, anticipate, 
monitor and respond in order to create a resilient socio-technical system. They can, of 
course benefit from the resilience of the system as well, which is important, especially 
in safety contexts. These interactions are different for each system. A few authors 
have already assessed this framework (see [4, 35, 164]). Especially for the factors 
anticipating and learning, it makes sense to consider the human being as a source of 
resilience. While the responding and monitoring within socio-technical systems is 
often performed by the technical components, the human being is able to take over 
tasks which serve the learning and anticipation ability of the entire system. Human 
operators are able to gain experience and to learn by repeating their control tasks, 
thus improving their behaviour [134]. They can adjust themselves according to the 
dynamic changes of the socio-technical systems.This requires adaptive and proactive 
behaviour (i.e. resilient behaviour) to control the system performances, especially 
when faced with unexpected situations. The metrics introduced in Sect. 6.3.1 can also 
be applied to human capabilities, for example the performance range or the buffer- 
ing capacity. The performance limits and reserves are defined in a socio-technical 


424 M. E. Pfetsch et al. 


system by technical and human performance numbers. Human performance can, 
for example, be defined as strength or cognitive performance. This definition deter- 
mines how reliable and measurable the performance limits are. Human performance 
often depends on intra-individual variance. This variance can also serve as a per- 
formance reserve. Examples of this can be found in safety research in the analysis 
of accidents in which people were able to activate performance reserves through 
unexpected behaviour (e.g. [164]). The buffer capacity can arise in a socio-technical 
system through redundancies or deliberate over-calculations. For example, humans 
can contribute to the buffer capacity by additionally securing certain processes within 
the scope of testing activities. Also the installation of transfer possibilities of the tech- 
nical system by humans increases the buffer capacity of the entire socio-technical 
system. 


Conclusion 


In order to design systems resiliently, it makes sense to strive for a socio-technical 
modelling. In order to promote certain properties of the system human behaviour and 
decisions can be presented as a source of increasing resilience. Human modelling is 
also necessary to rule out opposing effects, such as a reduction of resilience because 
of human decisions or behaviour that can increase errors or uncertainty. 


6.3.4 Truss Topology Optimisation Under Aspects 
of Resilience 


Tristan Gally, Philip Kolvenbach, Anja Kuttich-Meinlschmidt, Marc E. Pfetsch, 
Andreas Schmitt, Johann M. Schmitt, and Stefan Ulbrich 


Truss structures are load-bearing systems that are found in many applications of 
mechanical engineering. This includes the Modular Active Spring-Damper System 
presented in Sect. 3.6.1. As introduced in Sect. 6.1.1, a typical truss design problem is 
to find a truss topology that is as light-weight as possible while being stable enough to 
withstand certain load scenarios. In these design problems, there are various sources 
of uncertainty that need to be accounted for. For instance, typical optimisation meth- 
ods lead to truss designs that are stable only for a small, predetermined set of external 
forces; even small deviations from these forces can lead to extremely poor perfor- 
mance or failure of the structure. This issue is well studied in the field of robust 
optimisation, where the worst-case behaviour of a structure over a given uncertainty 
set of forces is decisive [17]. 

In Sects. 6.1.1, 6.1.2 and 6.1.3, we used robust optimisation to control uncertain 
loads for different models of truss topology problems. Robust optimisation can also be 
applied to other kinds of uncertain parametric dependency, e.g. material properties or 
manufacturing tolerances. However, sometimes sources of uncertainty are unknown 
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or cannot be quantified. In these cases, it can be worthwhile to move the focus 
from the source of the uncertainty to its impact on the truss structure. One possible 
approach is to design resilient truss structures in the sense that the truss remains 
stable even if a predetermined number of bars fail, for whatever reason, i.e., we use 
resilience to master ignorance, see Sect. 3.5. Following Sect. 6.3.1 we therefore also 
evaluate truss structures with respect to their buffering capacity. This strategy can 
be combined with robust parametric optimisation leading to light-weight robust and 
resilient trusses. To master the inherent structural uncertainty, cf. Sect. 2.3, in the 
truss topology design, we use mathematical optimisation, which takes the complete 
solution space into account. 

The consideration of complete bar failures in truss topology optimisation has 
started only recently except for [158], which considers only a small failure set. Contin- 
uous topology optimisation problems are considered by [99, 179]. Redundancy from 
coding theory applied to truss design is considered in [131]. Kanno [100] also designs 
resilient trusses according to our definition, however displacement constraints are not 
included in the model. Non-robust truss topology design under bar-failure is con- 
sidered in [155]. In the following we will extend the robust truss topology design 
problems from Sect. 6.1.1 and 6.1.2 to include resilience as presented in detail in [7, 
64]. 


Resilient truss topology design via semidefinite programming 


In this section we extend the basic robust truss topology design problem to also 
consider bar failures as shown in [7]. This will allow the computation of a resilient 
and robust truss with minimal volume. The base is formed by the robust truss topology 
optimisation problem 


. 2C max Q 
le Xe Sit. > 0, x>0, 
ver® 2 E ( Q x) 7 


which finds an optimal cross-sectional area x. for each bar e under a semidefinite 
stiffness constraint. Here, /, denotes the length of bar e, A(x) = Ir g Ac Xe is the 
stiffness matrix, Q describes uncertain forces on the nodes of the truss and Cmax 
is a bound on the compliance of the truss, which must not be exceeded. For more 
details see Sect. 6.1.1. A truss has a buffering capacity of k if the above semidefinite 
constraint still holds, even after up to k arbitrary bars have failed. This condition can 
be incorporated into the above formulation with the help of the set of failure scenarios 
Z={ze{0,1}*: Pece Ze < k}. For a failure scenario z € Z, bar e fails if and only 
if ze is 1. The failure of a bar can be represented by removing its influence on the 
corresponding stiffness matrix. Therefore, the stiffness matrix for a given failure 
scenario z is given by A(x, z) = } eg AeXe(l — Ze). The resilient design problem 
then reads 
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Table 6.5 Statistics for the computation of resilient trusses with buffering capacity k 


k Zi Relative volume Runtime in s 
0 0.19 
1 137 2.38 21.65 
2 9316 4.03 2240.18 


min Dix st x>0, (es ae a) > 0, forze Z. (6.20) 
EE 

The cardinality of Z, and thus the number of semidefinite constraints, increases 

exponentially with k, which makes this approach feasible only for small values of k, 

see [64]. For a different dynamic approach, see also the design of resilient water 

supply networks in Sect. 6.3.5. The following examples, however, use the complete 

set Z. 

Our approach is in the spirit of robust optimisation, see Sect. 6.1, and the presented 
solution methods in Sects. 6.1.1 to 6.1.3, as Z may be identified as an uncertainty set. 
However, a different solution approach is needed due to the discrete Z in contrast to 
the continuous ellipsoidal uncertainty sets considered there. 

Figure 6.26 shows three optimal crane truss structures with different buffering 
capacities k [7]. The nominal forces are displayed as arrows, the uncertainty sets 
as ellipsoids around them. In Table 6.5, the size of the failure set Z, the objective 
function value, and the runtime of the optimisation are displayed for three values of k. 
It is apparent and not unexpected that resilience does not come without a significant 
cost: Requiring the truss to be stable even after failure of any two bars, increases 
the volume by a factor of four and also the computational cost. Figure 6.27 shows 
the maximal increase of the nominal forces for different attack angles that the three 
trusses can sustain (0° means the forces face downward). It indicates a relationship 
between the different metrics to assess resilience defined in Sect. 6.3.1 as a greater 
buffering capacity leads to a greater performance range and margin, as well. 


(a) (b) 


Fig. 6.26 Resilient crane truss structures for two ellipsoidal uncertainty sets with buffering capacity 
ak=0,bk=1andck=2([7] 
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Buckling control in truss structures under bar failures 


An important cause of failure for truss structures is the buckling of individual bars, 
which is caused by excessive axial compressive loads and which cannot be detected 
through the compliance condition alone, see Sect. 6.1.2. As shown in [64], the opti- 
misation problem (6.20) can be augmented with buckling constraints to prevent bars 
to buckle in the optimal design. These buckling constraints also have to be copied 
for each failure scenario in Z in order to obtain a resilient structure with buffering 
capacity. Furthermore, variables for the bar forces for each failure scenario must be 
added. These are determined by so-called indicator constraints, in contrast to the 
equilibrium conditions used in Sect. 6.1.2, as the geometry matrix after the failure 
of bars is possibly singular. For more details see [64]. A passive option to avoid 
bar buckling is to increase the width of vulnerable bars. An alternative that helps to 
reduce the mass of the truss is presented in Sect. 5.4.7. It introduces active buckling 
control by integrating piezoelectric stack actuators in compact piezo-elastic supports 
at the bar ends and has been integrated in the robust problem in Sect. 6.1.2. 

Figures 6.28 and 6.29 show resilient truss structures with different buffering capac- 
ity and different number of active bars for the example presented in Sect. 6.1.2. The 
objective function values and computational costs are given in Table6.6. It can be 
seen that active bars indeed help to decrease the volume of the truss, but at the price 
of increased cost due to the actors. Note that the added weight of the actuators is not 
considered in the model. 


Conclusion 


In this section we have shown how to include bar failures into truss topology optimi- 
sation to design light-weight but robust and resilient trusses. Future research could 
investigate, whether the increased size by additional variables and constraints for 
each failure scenario can be avoided. 
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(a) (b) 


Fig. 6.28 Resilient truss for two load scenarios, k = 1 bar failures and different numbers r of active 
bars: ar = 0 active bars and b r = 2 active bars [64] 


x x 


Fig. 6.29 Resilient truss for two load scenarios, k = 2 bar failures and different numbers r of active 
bars: ar = 0 active bars and b r = 2 active bars [64] 


Table 6.6 Optimal objective values and solving times for different combinations of failure scenarios 
k and maximal number of active bars r [64]: (a) volume in 10° mm? and (b) solving times in s 


(a) 

Volume k=0 k=1 k=2 

r=0 1.9457 3.6088 7.4511 
r=2 1.7657 3.0205 6.4644 
(b) 

Time k=0 k=1 k=2 

r=0 7.47 52.26 890.23 
r=2 6.64 86.49 


581.77 
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6.3.5 Optimal Design of Resilient Systems on the Example 
of Water Supply Systems 


Lena C. Altherr, Philipp Leise, Marc E. Pfetsch, and Andreas Schmitt 


This section presents optimisation methods to consider resilience, as introduced in 
Sects. 3.5 and 6.3.1, in the design phase of a technical system. In order to master 
uncertainty, our goal is to find an optimal combination of different components 
constituting a resilient system structure, i.e. a structure which is able to tolerate and 
react to failing components. To assess and optimise resilience, we use the concept of 
buffering capacity described in Sect. 6.3.1: If a system has a buffering capacity of k, 
any k components can fail and a previously defined minimum system functionality 
is still fulfillable. We also say the system is k-resilient. 

In [9, 10] we have analysed a Mixed-Integer Nonlinear Programming (MINLP) 
model to design a cost-optimal but k-resilient water supply system for a high-rise 
building and presented a solution approach. A similar model has been validated 
in [133] with the help of a test rig. In the following, we briefly summarise the model 
and the solution algorithm presented. Furthermore, we review the found character- 
istics of the resilient designs. 

In comparison to Sect. 6.3.4, which presents the computation of k-resilient trusses, 
the basic models differ. Therefore, the computation of worst-case failures also dif- 
fers and needs to be treated differently. In both cases, the design of a topology is 
considered, and structural uncertainty is present, see Sect. 2.3. The consideration of 
buffering capacity further increases this uncertainty. 

For an overview on using MINLP to optimise water distribution networks (WDN) 
we refer to [41]. The literature on resilient WDN focuses on measures to quantify 
resilience and testing these on existing networks, see e.g. the well know resilience 
index by Todini [169] and the overview article [148]. For an example for an opti- 
misation of resilience using a surrogate measure in the context of WDN see [171]. 
The inclusion of component failures in layout optimisation can also be regarded as a 
defender-attacker-defender game model, see e.g. [5], in which the defender designs 
a layout. The attacker interdicts components in this layout, whereupon the defender 
reacts to these contingencies. These games can be understood as multi-stage optimi- 
sation/adjustable robust optimisation with integer variables, see [19, 102, 177]. In 
some cases the tri-level structure can be reformulated as a structure with only two 
levels, see e.g. [33] and the general bilevel solution approaches [53, 105, 129]. 


Optimisation model 


In high-rise buildings, pumps are used for pressure-boosting in order to supply all 
floors with water. In each pressure zone, a given pressure and volume flow demand 
has to be fulfilled. The aim of the optimisation model is to design a pump and 
pipe system which fulfils these demands and minimises operating and investment 


430 M. E. Pfetsch et al. 


> 
| 


N 
| 


pressure increase in m 


oO 


? volume flow in m? /h 


(a) (b) 


Fig. 6.30 Features of decentralised water supply systems: a possible discrete decisions (grey) and 
exemplary solution (black), b exemplary characteristic diagram 


costs. In order to do so, each floor has to be connected to the ground floor either by 
connecting it directly or by connecting it to a lower floor. Thus, the topology as well 
as the diameters of the resulting pipe network have to be determined. These possible 
pipe layouts are restricted to be tree-shaped, i.e. each floor is connected to exactly 
one lower floor. Further discrete decisions concern the placement of pumps. The 
model equally determines the cheapest pump operation to provide water. Altogether, 
the model contains discrete decision variables, such as pipe and pump placement, 
as indicated in Fig. 6.30b, and nonlinear non-convex constraints to approximate the 
pump characteristic diagrams, as shown in Fig. 6.30b. This leads to a complex mixed- 
integer nonlinear problem which is already strongly NP-hard to solve for k = 0. 


Computation of resilient solutions 


To obtain solutions which are robust against uncertain pump failures, we developed 
a method to find a k-resilient system which minimises the investment and operating 
costs in [9, 10]. In order to integrate this robustness we define the set of failure 
scenarios 


Z= |z € 0,1)" : > <k}, 


i=1 


where we have enumerated all possible pumps in the building from 1 to n. Thus, for 
scenario z € Z, the entry z; is 1 if and only if pump i fails in the scenario. Using 
this set, we can guarantee resilient system structures by modelling the successful 
operation of the system for each failure scenario z € Z, even though the pumps 
given by z fail. 

Integrating all scenarios in Z in the model would lead to exceedingly large solution 
times, due to the exponential growing cardinality of Z with respect to k. Therefore, 
an iterative strategy is used. We solve models which only consider a subset Z’ of Z. 
For a solution, we compute a worst-case failure scenario in Z. If the solution can 
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Table 6.7 Shifted geometric mean of solving time in seconds and number of instances solved with- 
ing the timelimit, clustered by number of pressure zones and buffering capacity k with 36 instances 


# zones k 
0 1 2 3 4 
7 Time 412.62 847.73 1087.60 1252.01 1414.59 
Solved 36 36 36 36 36 
8 Time 3315.81 6388.67 6733.21 6570.97 6451.66 
Solved 36 22 15 10 11 


sustain this scenario, the optimal resilient solution is found. Otherwise, the failure 
scenario is added to Z’ and the model is solved again. 

This scheme is further adapted to the use case of the high-rise building. Due to 
the tree-shaped network topology and the usage of only parallel pumps of the same 
type, the volume flows in each floor and in each pump are pre-determined for a fixed 
pipe topology. Thus, the number of nonlinear constraints decreases. Furthermore, 
for the optimal placement and operation of pumps on this topology, resilience can be 
modelled by a set of linear inequalities for each failure scenario. These inequalities 
can be separated by a simple dynamic program with running time polynomially 
bounded in the input parameters. Thus, a branch and bound scheme which branches 
on the pipe connections from the bottom to the top was developed. Computational 
tests in [10] show the computational benefits of this approach. 

To further improve running times an alternative representation of the characteristic 
diagrams independent of the operating speed presented in [137] can be used. This 
representation is convex allowing the usage of perspective cuts introduced in [56]. 
New computational results for the combination of the branch and bound scheme and 
these cuts are presented in Table 6.7 for the test instances and test environment used 
in [10]. The modification allows solving instances with one more pressure zone and 
larger buffering capacity. An increasing computational burden for increasing k and 
an increasing number of pressure zones is observable. 


Assessment of resilience 


In the following, we discuss some findings which can be useful to understand the 
advantages and properties of resilience. This is possible since we are able to rapidly 
compute resilient solutions with the above presented scheme. Thus, we can compare 
resilient solutions for different parameters. 

Figure 6.3la shows the power consumption and investment costs of all Pareto- 
optimal solution topologies with respect to power consumption and investment costs 
of a building with six pressure zones and different levels of k-resilience. There exists 
no solution topology which, at the same time, is more energy-efficient and cheaper 
than the depicted solutions. We first note that larger investment leads to lower energy 
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Fig. 6.31 Resilience properties: a three and two-dimensional depiction of power consumption and 
investment costs of Pareto-efficient topologies, b solution costs for exemplary optimal k-resilient 
solutions, c maximal volume flow these solution can maintain after worst-case failures 


costs, since more pumps are built, which can then be operated more efficiently. It can 
be seen that the minimal investment increases, but also the worst power consumption 
achievable by a Pareto-optimal solution, decreases with an increasing k-resilience. 
This is due to the increased number of pumps needed to guarantee fault-tolerance. The 
overall positions of the solutions are coherent with the observation that the number 
of pumps and thus the investment costs increase with more emphasis on the energy 
costs. Interestingly, for a small power consumption (< 9kW) a large number of 
different Pareto-optimal solutions exists. Small efficiency improvements correspond 
to large changes in the investment costs. The best power of around 8.9 kW is for larger 
k only achievable with greater investment costs. However, due to the great density 
of solutions, resilience can be achieved for this efficiency without big disadvantages. 
We furthermore see that for solutions with a power consumption of at least 9kW 
the investment costs tend to scale almost proportional to the resilience factor k with 
a proportionality constant smaller than 1. This contrasts an exemplary conventional 
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redundant design strategy, which could build every pump of the 0-resilient solution 
k + 1 times and would scale with a proportionality constant of 1. 

In [9] the characteristics of resilient designs are analysed for an exemplary appli- 
cation for k € {0,..., 3} with seven pressure zones. Using perspective cuts, we are 
able to solve this application for nine pressure zones leading to different solution 
topologies. Despite the difference in the number of pressure zones, we will draw 
very similar conclusions on resilience in the following to the ones in [9]. 

The price of resilience is mainly due to the increased number of needed pumps 
as observable by the solution costs depicted in Fig. 6.31b. Nevertheless, it is a lot 
more advantageous than a pure strategy of redundancy. Placing another pump in each 
pressure zone used of the non-resilient design increases the investment costs by more 
than 50 %, whereas the topology with a buffering capacity of k = 1 instead of k = 0 
is only 5 % more expensive. The additional pumps which are needed for resilience 
are even able to decrease the operating costs for the k = 2 solution. It remains similar 
for the other levels of resilience. 

Several metrics to quantify resilience have been introduced in Sect. 6.3.1, and it 
is not clear whether the choice of buffering capacity is preferable to other metrics in 
the design of a resilient high-rise water supply system. Nevertheless, it is indicated 
in [9] that consideration of the buffering capacity is also linked to the improvement 
of performance range, radius of performance, and margin. We obtain the margin for 
each solution, by computing the worst-case combination of one up to three failing 
pumps and the subsequent maximal volume flow which can be transported, compare 
Fig. 6.31c. In these computations, the minimal functionality after failures was defined 
as 80 % of the design point volume flow of 28 m?/h. Thus, each k-resilient solution 
lies above the dotted line for up to k failures. It can be seen that resilient solutions 
are oversized for standard operation, since without failures they exceed the required 
volume flow of 28m?/h. Thus, we claim resilience is a property which has to be 
actively sought for. Conventional methods will seek solutions which are “just right” 
for the given operating point and have no reserves. We again observe that our approach 
for resilience is finer-grained in comparison to simple redundancy. The solution with 
a buffering capacity of k = 3 is not just obtained by including another pump to the 
solution which considers two pump failures. This is the case, since the latter has the 
largest reserves for one and no failures. 

An observation specific to resilience and the design of decentralised high-rise 
water supply networks has been made in [10]. Here it has been shown that increasing 
the weight of the energy costs, i.e. shifting the importance of investment versus oper- 
ating costs, leads to solutions which are branched out, whereas demanding greater 
resilience tends to solutions that connect the floors in series. This can be explained by 
the fact that in the former layout one pump can supply fewer floors than in the later 
scheme. Thus, it has fewer redundancies and is inferior with respect to resilience 
aspects. 
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6.3.6 Application of Resilience Metrics to the Fluid Dynamic 
Vibration Absorber in Drop Tests 


Nicolas Brötz and Peter F. Pelz 


If we want to apply resilience properties, we must be able to assess the system’s 
resilience. For this purpose, we defined the resilience metrics in Sect. 6.3.2. We eval- 
uate drop tests of the Modular Active Spring-Damper System (MAFDS), presented 
in Sect. 3.6.1, with the Fluid Dynamic Vibration Absorber (FDVA), see Sect. 5.4.4, 
to apply these metrics to a technical system in comparison to a conventional damper. 

A vibration absorber is used to reduce vibrations from an oscillating system. A 
conventional dynamic vibration absorber consists of a heavy mass and a capacity. 
However, this additional weight counteracts the goal of a lightweight construction. In 
contrast, the FDVA reduces the dynamic mass by the use of hydrostatic transmission, 
see Sect. 5.4.4 

The MAFDS, shown in Fig. 6.32 represents a dual mass oscillator and is therefore 
suitable for demonstrating the functionality of the FDVA. The purpose is to reduce the 
vibrations of the lower structure. Since this lower structure is a single mass oscillator 
comparable to a wheel, we will refer to it as wheel in the following. We consider a 
maximum wheel load for the lower structure, which is important in drop tests. The 
tests in the MAFDS are designed in such a way that possible influences, such as a 
change in the body mass, can be investigated in order to address the data uncertainty 


Fig. 6.32 Test rig of the 
MAEDS for drop tests with 
integrated FDVA 


body/ 


upper 
structure 


FDVA 


wheel/ 
lower 
structure 


impact 
plate 
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of the load-bearing system, see Sect. 2.1 and apply the resilience metrics, defined in 
Sect. 6.3.1 to the usage of the FDVA. 


Drop test of a dual mass oscillator 


The MAFDS, which incorporates the technologies damper or FDVA, is dropped 
during the measurements with a variation of additional weight on the upper struc- 
ture (body) to vary the body size and represent incertitude. The additional weight 
addresses the unknown loading conditions and is varied in 20kg steps from 0 to a 
maximum additional weight of 80kg. The test rig is shown in Fig. 6.32. 

The MAFDS is similar to a car suspension strut because both are dual mass 
oscillators. A drop test is an unusual but possible use case. The driver might steer 
the car at a high speed down a sidewalk. A scenario which is not in focus of the 
suspension strut adjustment. 

The MAFDS is in free fall of 30 mm until impact. For each drop test, the force at 
the impact plate is recorded. This force is equal to the wheel load Fw. Figure 6.33 
shows the wheel load Fw over time for a drop test without additional weight. The 
FDVA has two opened ducts to realise an eigenfrequency of 10 Hz. This is the nearest 
possible frequency of the FDVA to adapt the lower structure eigenfrequency. The 
better the eigenfrequencies match, the better the wheel load fluctuation is reduced. 
We calculate the lower structure eigenfrequency w = ./k/m by lower structure mass 
m and the stiffness k of the elastic foot. 

The first peak for both measurements with damper and FDVA is the first lower 
structure contact to the impact plate. We measure the highest wheel load when the 
upper structure compresses the suspension. The highest wheel load is the critical 
load. At this point the highest force acts on the wheel and thus on the tire. The 
MAFDS in our case has a rubber buffer, that cannot burst, instead of a tire. Thus 
we are able to perform drop tests with high wheel loads at which a real tire would 
already burst. 
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To quantify uncertainty we consider the resilience metrics defined in Sect. 6.3.1. First, 
we define the functional performance. For this example the functional performance 
1/Fmax is the inverse of the maximum wheel load. The influencing factor is the 
additional weight. The design point is the MAFDS without an additional weight. 
To measure the resilience we need to define a minimum performance. The critical 
element in such a use case is the tire. The tire has a load index which defines how 
much weight it can carry. For this example, a tire with a load index of 91 is chosen 
because this load index is used for cars with body mass similar to the MAFDS. The 
load index 91 allows to carry 615 kg. The static load should be the maximum load the 
tire is exposed to. This is equivalent to the minimum functional performance fmin- 
In Fig. 6.34 the functional performance is normalised by the minimum functional 
performance. Every point below this minimum represents a failing system. Failing 
means, the tire could burst due to excessive load. With this definition, we can compare 
the resilience of a damper and the FDVA. We can see that the FDVA has a higher 
functional performance. The FDVA’s margin at zero additional load is 4% higher 
than the damper’s margin. 

The radius of performance defines the minimum distance between the design 
point and the point for which the functional performance undercuts the minimum 
functional performance fmin. This radius of performance is 70kg of additional load 
for the damper. The radius of performance for the FDVA is higher than the performed 
tests. Therefore, the resilience of the MAFDS can be increased by using the FDVA: 
even at an additional load of 80kg and higher the system guarantees a predetermined 
minimum of functional performance. 

The performance range in this example is equal to the radius of performance 
because there is a constant decrease of functional performance with higher additional 
load. To evaluate the gracefulness, measurements with the FDVA at higher additional 
loads would have to be performed resulting in a destructive test. Thus, we do not 
evaluate the resilience gracefulness here. 
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Fig. 6.34 Normalised functional performance for drop tests for FDVA compared to a damper 
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Conclusion 


In technical systems where a critical minimum exists, which defines the minimum 
functional performance, we can calculate the resilience metrics margin and radius of 
performance. In the drop tests the radius of performance has a higher use case than 
the margin because it describes how uncertain the additional load can be until the 
system fails. But to evaluate the radius of performance, tests with failure have to be 
evaluated in a normal case. 

The margin is useful to quantify the standard usage with no additional weight. In 
this drop test we have an improvement of 4% of functional performance with FDVA 
in relation to a standard damper. But the value of margin on its own can not give an 
information about when the system fails. 


6.3.7 Concept of a Resilient Process Chain to Control 
Uncertainty of a Hydraulic Actuator 


Ingo Dietrich, Manuel Rexer, and Peter F. Pelz 


The concept of resilience is not only applied to master uncertainty during design, 
but equally to connect the product life phases production and usage, (Chap. 3) by 
integrating the four resilience functions monitoring, responding, learning and antici- 
pating [88], see Sect. 6.3.1. Within the product life phases production and usage, the 
state of the art is to establish variable process windows to master uncertainty. For 
example, modern cars have flexible oil changing intervals, based on numerous oper- 
ating parameters of the engine. However, currently the connection between the life 
phases production and usage is still formed by the product design. Customer feedback 
or guaranteed returns are analysed individually, and the component life, described 
by usage and environmental parameters, is deduced. Ultimately, the product or its 
production are changed to cope with the findings. 

Today, an increasing number of technical products offers the possibility to collect 
data during the usage phase. Paired with the development of technologies, such as 
single part tracking, the increasing modelling of production processes and process 
chains, resilient product life phase spanning process chains become possible. In this 
section, we show the general concept of this resilient process chain and apply it to the 
hydraulic actuator of the Active Air Spring introduced in Sect. 3.6.2. We introduce 
production uncertainty to individual parts of the actuator and conduct experiments 
to determine the effect on usage parameters. 


General concept of resilient process chains 


The concept of a product life phase spanning a resilient process chain was presented 
by Dietrich et al. in [45] and is shown in Fig. 6.35. Based on the production plan, a 
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Fig. 6.35 Product life phase spanning process chain as presented by Dietrich et al. [45] 


technical component is produced. The individual production steps are described by 
models that use measured parameters during production. Following the nomenclature 
introduced in Sect. 1.5, the production and usage plan are structures S, described by 
functional relations f, that rely on data b. (Soft-)sensors feed models that aggregate 
information during the usage. By a suitable selection of data that are logged during 
production as well as during usage, the data can be matched and compared. Mostly, 
the data obtained from production and usage is not the same, thus correlating models 
for the matching need to be developed. For example, these models may be devel- 
oped by domain-specific experience or empirical correlation. By the feedback of the 
differences between actual data from production and identified data from usage, the 
models can be adapted and a learning function might be established. Using time 
histories and correlating single part data to the respective usage data, the component 
behaviour can be anticipated already in the production itself. Based on this anticipa- 
tion, the usage plan of the component can be adapted. In reference to Sect. 3.5 and 
Fig. 3.16 ‘the system function is evolving’, thus enabling resilience. The resilient 
process chain deals with structural uncertainty, according to the Sects. 1.5 and 2.3. 

The concept of a resilient process chain results in four requirements for the pro- 
duction and the usage of the component. 


1. Production parameters must have an influence on the usage. 

2. Data that can be measured during production as well as during usage must be 
identified. 

Data during production and usage must be collected. 

4. Models that process the measured data from production and usage must exist. 


5 


Resilient process chain applied to the active air spring 


In the following, we want to evaluate this concept by applying it to the Active Air 
Spring, which is described in detail in Sect. 3.6.2. The Active Air Spring is an active 
system that combines the advantages of an air suspension, such as level control or 
the load-independent body eigenfrequency, with those of an active system that can 
actively reduce vibrations and has a flexible working area. For example, it can be 
used to minimise kinetosis during autonomous driving of cars [83]. 

The active elements are two hydraulic diaphragm actuators with linear moving 
segments, which vary the load-bearing area of the Active Air Spring. Each segment 
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Fig. 6.36 Part of the process chain for machining, assembly and usage of the hydraulic diaphragm 
actuator. Solid lines represent material flow and dashed lines information flow. The parameters we 
focused are bold 


has two pistons that run in a sliding bushing and is actuated with hydraulic oil. For a 
more detailed understanding of these actuators we refer to [83, 84] and Sect. 3.6.2. 

To evaluate the concept of the resilient process chain, we want to focus on a rather 
simple mechanical property of these segments. In Fig. 6.36 the part of the process 
chain for the final machining, assembly and usage of the hydraulic diaphragm actuator 
is shown. It is the most crucial part of the production for the functional performance 
of the actuator. The process steps reaming, assembly and usage are labeled with 
examples for relevant parameters in the according step. In difference to a classical 
production chain we want to use information from each step in models to perform 
predictions on the one hand, and to improve the process steps on the other hand. As 
presented in Sect. 6.1.8, we have existing models for the reaming process. Typically, 
reaming within a process chain happens at the end of the value chain. Its purpose is 
to produce the shape and position of functional bores within the required tolerance 
range [42]. For productivity reasons, nowadays often multi-blade reamers are used 
where the functions “cutting” and “guiding” are combined in one geometric element. 
The production of precision bores using multi-bladed reamers is the subject of various 
scientific studies. Uncertainty in the form of disturbances regularly influences the 
reaming process in industrial practice. Typical disturbances are axis misalignment, 
run-out errors and inclined surfaces with sloped pilot holes [23, 24]. 

The influence of disturbances on the quality of the reamed bore has been investi- 
gated with regard to diameter, circular shape and cylindrical shape [21, 110] as well 
as with regard to the deflection of the tool [25, 82]. A deflection of the tool leads to 
an increased diameter of the casing cylinder of all bore centres of the reamed bore. 
This in turn leads to an increase of the casing cylinder of all bore centres [26]. The 
current object of research is the development of an online prediction model, which 


440 M. E. Pfetsch et al. 


uses information from the respective individual processes production via sensors for 
process control and final quality control. This means that an online quality prediction 
is available in the future. 

For a first insight, we apply an artificial production uncertainty to the reamed bores 
of four moving segments. As the prediction model mentioned above helps us to detect 
the uncertainty in the future, we choose an axis misalignment to simulate a production 
uncertainty. Qualifying an assembly process for a small number of parts is challeng- 
ing, thus we neglect the assembly process (shrink fitting of the pistons) and measure 
the result. The distance of the centre lines of the two pistons isd = 26mm + ô, where 
6 is the axis misalignment. The design point is dor = 26mm. After assembly, the 
misalignment ô of the bores measured to 6 = [—28, —5, 32, 85] "m for the four pro- 
duced moving segments. These values are all within the sliding bushes tolerances, 
according to the datasheet [45, 130]. From numerous previous experiments with the 
actuator itself [84] and during the usage inside the Active Air Spring (Sect. 3.6), we 
know that assembly and disassembly, changing the membranes and mounting in the 
test bench are robust in respect to the experimental results. 


Experimental evaluation of the productions influence on the usage 


In our experimental evaluation we want to investigate the influence from the pro- 
duction on the relevant usage parameters. To generate a viable data-set of the usage 
phase, we use a Hardware-in-the-Loop test rig, in which the hydraulic diaphragm 
actuator can be investigated without being mounted inside the Active Air Spring [45, 
84]. For a more detailed insight on Hardware-in-the-Loop tests in general, we refer 
to Sect. 4.3.4. The test rig enables the characterisation of the actuator to calculate its 
efficiency, as well as the simulation of a road ride in a car equipped with the Active 
Air Spring. The efficiency is calculated by the input energy Win and the dissipated 
energy Wgis as 

_ Win — Wais 
2: Win 
For a detailed understanding of the characterisation we refer to [45]. To increase the 
wear-rate, we use an axial counter force to the moving segments of the actuator four 
times as high as in a typical application. To get a time series of usage data, we iterated 
between a characterisation cycle which allows us to calculate the desired parameters 
and a cycle with a road signal (national highway with a speed of 100 km/h) [128]. 
We perform a characterisation after each hour of a road signal. At the end of each 
test, we took an oil-sample and analysed it in the lab. The effort for the tests is high, 
due to the assembly process of the actuator and the runtime needed for results. Thus 
the number of experiments had to be limited. 

Figure 6.37 shows the experimental results for the four specimen. Figure 6.37a 
shows the efficiency over the run-time. We can see a general trend for a decreasing 
efficiency over the run-time, which results from the wear of the sliding bushes. From 
—28 um to 32 um the efficiency rises. From 32 um to 85 um it decreases. This leads 
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Fig. 6.37 Experimental results for the four different segments: a the efficiency over the run-time 
for the four different segments, b the particle load in the hydraulic oil after for each segment 


to the assumption that the chain of tolerances ‘bores in the actuator body—sliding 
bushes—pistons’ has its optimum between —5 um and 85 um. Figure 6.37b shows 
the particle load in the hydraulic oil samples after the respective test was finished. In 
contrast to the reference sample of the oil three materials occur. Copper, molybdenum 
and tin are all used in the sliding bushes [130] and result from wear. The particle load 
correlates with the efficiency results. The 32 um sample has the highest efficiency, 
thus the lowest friction and wear, which results in the lowest particle load in the oil. 
It should be mentioned, that these results cannot be transferred one-to-one to the real 
usage phase of the Active Air Spring, as the load was increased for a faster wear 
of the sliding bushes. The experiments show that there is an effect from the final 
production stage (reaming) on the usage of the Active Air Spring, or the hydraulic 
diaphragm actuator respectively. This effect is already measurable for production 
uncertainties that lie within the sliding bushes tolerances. However, the actuator 
could be assembled and was working as intended for all four different segments. 


Conclusion 


At the end of this section, we give an outline of a possible resilient process chain in 
the future: We use reaming models during the production to predict the quality of the 
bores. An empirical model correlates the bore quality to the outcome of the assembly. 
Another empirical model, gained by preliminary tests and real usage data, predicts 
the individual component’s usage parameters. Resulting user stories would read: 
‘Based on the quality during production, the oil-changing interval for the individual 
actuator is determined.’: Referring to Sect. 6.3 a disturbance in the production phase 
is mastered in the usage phase. The minimal functional performance for the actuator 
life time is ensured by reacting to the production disturbance with the adaptation of 
the oil-changing interval. ‘Based on the quality during production—and the predicted 
efficiency, an inefficient actuator is combined with a very efficient hydraulic drive 
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(which has natural production tolerances as well)’: The functional performance of 
the production chain to produce a certain percentage of good parts is ensured. 

Within this Section we presented the concept of a resilient process chain, connect- 
ing the product life cycles production and usage. The investigations on the hydraulic 
actuator of the Active Air Spring showed that the production influences the usage. 
We further outlined how the process chain will look like in the future. Today, the 
lack of availability of data during both life cycles is still a challenge for real world 
applications. However, the number of products, delivering data during their usage 
phase and the digitalisation of the industry is increasing. 


6.3.8 Experimental Evaluation of Resilience Metrics 
in a Fluid System 


Philipp Leise and Lena C. Altherr 


As mentioned by Folke et al. in [55, p. 1], a resilient system has the ability to “con- 
tinually change and adapt yet remain within critical thresholds”. Folke et al. focused 
on the resilience of socio-ecological systems. Nevertheless, this concept, as already 
mentioned earlier in Sect.6.3.1, can be transferred to the domain of mechanical 
engineering. While this concept is easily understood, the transfer to the domain of 
mechanical engineering is more challenging. We present a modular test rig, that 
is used to evaluate the applicability of the four functions (monitoring, responding, 
learning and anticipating) to derive resilient systems on the one hand and investigate 
selected resilience metrics experimentally on the other hand. We refer to Chaps. 1, 
3 and Sect. 6.3.1 for a broader introduction to resilience of technical systems. 

The focus of the considered resilience metrics that can be evaluated at the test rig, 
is set on the metrics, which correspond to an adaption of their behaviour over time. 
As mentioned at the beginning of this section, a resilient system has the ability to 
continuously adapt to external changes. These changes can be initiated by “exogenous 
drivers [...] and endogenous processes”, as noticed by Walker et al. in [173, p. 3]. The 
test rig in its modular and variable design is capable to host multiple experiments for 
a large variety of resilience metrics that consider both “exogenous drivers” and/or 
“endogenous processes”. It is designed to be able to derive basic implementation 
ideas and to present proof-of-concepts for metrics shown in Sect.6.3.1. Therefore, 
we will present a brief overview of its capabilities and discuss the outcomes of the 
selected experiments. 

The test rig with an exemplified piping is presented in Fig. 6.38. The purpose of 
this test rig is to supply water in each of the two acrylic water tanks which are depicted 
on the right side in Fig. 6.38. We are able to read out and control multiple sensors and 
actuators. As actuators there are up to three pumps and up to ten control valves. For 
instance, we can use a control valve as an exogenous driver as introduced in [173] to 
induce external disturbances on the water supply system within the test rig. We have 
the possibility to place multiple pressure sensors at different locations in the system. 
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Fig. 6.38 Test rig to illustrate the application of different resilience metrics 


Additionally, we can measure the power demand of each pump, the water temperature 
at four locations and the opening of all electrically actuated control valves. This sensor 
data can be evaluated in real-time on the affiliated computer system. We implemented 
a Python-based control system to be able to use all available sensors and actuators 
for each dedicated experiment. 

In addition to the design and implementation of the test rig, we derived a simulation 
model based on Modelica, cf. [61, 167], which represents the basic structure of the 
test rig. This simulation model was first validated by experiments at the test rig 
and then used to derive a database of simulation runs, where each run represents 
a dedicated disruption scenario. This database can then be used to derive a system, 
which can automatically reconfigure itself in case of external or internal malfunctions 
based on the pre-calculated system behaviour. This approach eliminates the need to 
conduct multiple runs of actuators within the real system to derive system models in 
case of failures, as this is done in other domains, see e.g. [27]. 

We conducted multiple experiments on this test rig, to verify the usage and appli- 
cability of predefined resilience metrics, which we will briefly present in the follow- 
ing. Moreover, we assessed the four functions (monitoring, responding learning and 
anticipating) of resilience, as introduced in Chap. 3 and Sect. 6.3.1, with the help of 
our test rig. 


Resilience triangle 


We conducted experiments with specific resilience metrics, as introduced in Sect. 6.3.1 
and [7]. We refer to Sect. 6.3.3 for a more detailed view on the functional performance 
and to Sect. 6.3.5 for more details on the buffering capacity. Within this section, we 
will only focus on the practical usage of the resilience triangle, as shown by Bruneau 
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et al. [30]. We introduced the resilience triangle in Sect.6.3.1 and showed the gen- 
eral approach for calculating the metric value R. We adapt this approach, comparable 
to [135], by normalising the error ratio compared to the predefined minimum per- 
formance. Additionally we approximate the integral given in Sect.6.3.1 with a sum 
over all measurements in time ¢ with the time step length Ar: 


u Thost max{0, I: _ f(yAat 
i 2 Jore (tpost = tpre) l 


(6.21) 


t=tpre 


This enables us to compare an undisturbed system response (r = 0) with a disturbed 
system response (0 < r < 1). The system response after a sudden disturbance is 
shown in Fig.6.39a, while Fig. 6.39b shows a correlated signal, as introduced in 
Sect. 6.3.2, which can be used besides the direct measurement of the water level, to 
derive rule-based learning and anticipation strategies. As a disturbance, we used a 
square-wave (0.02 Hz, offset 70% of maximum command signal, amplitude 30 % 
of maximum command signal) as a reference signal for the valve displacement. 
This signal was transmitted to the valve using the commercial National Instruments 
software as well as custom-developed Python software. 

The system is able to reach the setpoint value ( fpre), which is in our case equiva- 
lent to the minimum performance, while the disturbance is still active. If we evaluate 
Eq. (6.21) on the shown example we get r = 0.252 if we consider fpre = to and 
toost = tı. The metric r can also be interpreted as the percentage of lost functional 
performance in the given time period. This loss is marked in grey in Fig. 6.39. Addi- 
tionally, if we also consider the performance loss after the external failure period 
(hatched in Fig.6.39a) we get r = 0.202 (tpre = to, tpost = 12). After stopping the 
disturbance signal (t > tı) the considered controller tends to overshoot and pro- 
duces a second performance loss before finally reaching the setpoint function. The 
experiment shows that an extension of the resilience triangle as given in Eq. (6.21) 
can be used to compare the resilience of different systems (e.g. different controllers) 
on common failures and common time horizons. 


Four functions of resilience 


Next to the quantification of resilience, we show the usage of the four functions of 
resilience, i.e. monitoring, responding, learning and anticipating, and evaluate the 
applicability of this concept on the test rig system, cf. [115]. We start to evaluate this 
resilience approach, by using one proportional-integral-derivative (PID) controlled 
pump to set the height of water in one tank. As a disturbance, we use a control valve 
(marked with (1) in Fig. 6.38) to disrupt the system at a given point in time, after 
the steady-state is reached. We try to minimise negative deviations from the desired 
reference water height, while positive deviations in the water height are accepted. 
This allows to derive a system representation that is related to classic resilience 
examinations, as for instance shown by [30, 165]. 
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Fig. 6.39 Measurement of a sudden disturbance on the test rig system. a measured signal of water 
height b indirect measurement of the disturbance in the pump power signal 


Resilient systems should adapt to changes continuously, as proposed in [55, 173]. 
This goal is promising, but difficult to reach, as the resulting system must be adaptive 
and not only flexible, cf. Sect. 6.3.2. 

The four functions of resilience are used to build a more resilient system that can be 
seen as a first step towards a resilient system that can master arbitrary disturbances. 
If the disturbance is severe, the traditional system design with a PID controller 
is unable to retain the predefined functionality. As the presented system has only 
little possibility to adapt its behaviour, we chose to build a system that can partially 
anticipate future disturbances and adapt its behaviour accordingly to reduce the 
future loss in functionality. Therefore, we implemented among other methods (for 
more details we refer to [115]), an exemplified learning model, which is based on an 
auto-regressive (AR) model, cf. [29, 132]. It models and predicts the behaviour of 
the complete system based on the current system response in the time-domain. This 
approach is also known as a method of system identification for dynamical systems 
as shown in [95]. To train the AR model, we split a time-series of stored values, 
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Fig. 6.40 Exemplified measurement of the system adaption based on the four functions of resilient 
systems. The measurement data is based on an experiment conducted for [115]. a performance 
measure of the considered system b normalised aggregated loss of functional performance which 
is based on the resilience triangle 


which were measured at the test rig in a training (70%) and a test set (30%). The 
training set is then used to train the underlying AR model, while the test set serves to 
evaluate the performance of the trained AR model. Overall, there are five different 
training-test-splits within cross-validation, [13]. 

An exemplified system adaption is shown in Fig. 6.40. The system is adapting its 
behaviour based on the automatically detected deviation of the defined functionality. 
The system tries to recover over time by adding additional water in the reservoir 
when possible to avoid a severe decrease under the predefined reference performance 
value in the case of anticipated future losses. This approach enables the system to 
minimise its performance losses with a time-depending strategy that is based on the 
anticipated disturbances. It is important to mention that the algorithm does not use 
any measurement signal related to the control valve displacement that represents the 
“exogenous driver” as introduced in [173] within the conducted experiment. Instead 
it autonomously develops a model of estimated future disturbances. 

The “resilient system” tries to minimise the negative deviation from the desired 
reference performance for all time steps within a detected disturbance in Fig. 6.40a. 
It learns and anticipates future losses that are caused by the changing valve opening, 
which simulates a severe disturbance. The reference system uses a classic design 
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with only one PID controller, which is unable to minimise the losses over time. 
The “resilient system” shows a consecutive adaption capability, where comparable 
losses within an active disturbance only occur at the beginning. The reference system 
design results in a more than two times higher loss over the considered time period, 
as shown in Fig. 6.40b. 


Conclusion 


We conclude that the experiments conducted at the presented test rig show it is 
possible to transfer the considered resilience concepts and metrics of Sect. 6.3.1 and 
[7] to the mechanical engineering domain, and therefore to other technical systems 
demonstrating uncertainty as given in Sect. 3.6. Furthermore, the shown algorithmic 
approach which is based on the four functions monitoring, responding, learning, and 
anticipating is suitable to derive more resilient technical system designs. 
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Chapter 7 A) 
Outlook Chesktor 


Peter F. Pelz®, Peter Groche®, Marc E. Pfetsch®, 
and Maximilian Schaeffner® 


Bertolt Brecht once closed a text with the words “We are disappointed to see the 
curtain close and all questions are left unanswered” [1]. In this book, it has become 
clear that uncertainty is immanent in the product life cycle of technical systems in 
mechanical engineering from (B) production, (C) usage, (D) reuse to (E) sourcing. 
The latter is the starting phase of the following sequence B, C, D, E. Uncertainty 
has been relevant since the beginning of the industrialisation, cf. Theodor Fontane’s 
ballad “The Tay Bridge’ quoted in Chap. 1 and this will continue to be so. Hence, we 
will never see “the curtain close”, but a perpetual contribution of engineering science, 
applied mathematics, law and further branches of science to master uncertainty in 
mechanical engineering. 


7.1 Towards the Complete Picture 


The product life sequence B, C, D, E spans the temporal dimension. The spatial 
dimensions are captured by the system boundary. With further increasing system 
boundaries, we go from material to component and from techno-economic to socio- 
technical systems. In this outermost system boundary, market forces, social impact 
and regulatory rules become prominent. 

In the presented book, we focused on (A) product design and the two phases 
(B) production and (C) usage of the product life cycle, cf. Fig. 1.6. Of course, 
this is not the complete picture: mastering economic uncertainty and uncertainty 
in acceptability, inevitably needs a holistic view on the product life sequence on 
the one hand and the extended system boundaries on the other hand, cf. Fig. 7.1. 
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Fig. 7.1 The product life sequence B, C, D, E—rather than a cycle—is represented by the four 
phases (B) production, (C) usage, (D) reuse and (E) sourcing. The spatial dimensions are cap- 
tured by the system boundaries extended from material to the socio-technical system. The phases 
(A) product design, (F) stakeholder interaction and market regulation as well as (G) FAIR data 
management address all temporal phases and system boundaries as indicated. The trajectory of 
the system in a Lagrangian representation shows the individuality of each system composed of 
individual components. The cloud symbolises the Eulerian observer fixed in space. This change of 
reference enables the feedback to subsequent similar phases as well as to (A) product design and 
(F) stakeholder management. Hence, (G) FAIR data management enables on the one hand learning 
from previous similar events; on the other hand it enables transparent quality KPI 


It is evident that the relevant time period, the product life sequence, includes the 
phases (D) reuse/recycling and (E) sourcing. The second law of thermodynam- 
ics teaches us that there are no real systems without impact exceeding the phase 
(D) reuse/recycling [4]. Hence, it is indeed better to speak of product life sequences 
B, C, D, E, B, C, D, E ... rather than a product life cycle. 

The spatial extension of the system boundary from material, cyber-physical com- 
ponents, systems and services towards techno-economic or socio-technical systems 
needs not only contributions from (A) product design. Understanding and possibly 
control of (F) stakeholder management is as relevant as the (G) FAIR data man- 
agement, where FAIR is the acronym for Findable, Accessible, Interoperable and 
Reusable. Stakeholder management includes analysis and control of stakeholder 
interaction as well as instruments for market regulation and market surveillance. As 
such, negotiating contracts is part of stakeholder management; the analysis of stake- 
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holder interaction typically is a field of interest for sociology but also for economics 
and political science. 

Some aspects of the extended view were indeed addressed in this book. Chapter 5 
is exemplary for this. Mastering uncertainty in the assignment of functional require- 
ment specifications and quality objectives needs the understanding of the stakeholder 
interaction combined with market regulation. The same is true for existing and emerg- 
ing legal constraints. It is expected that digital humanities will influence this field in 
the future even more. 

We are aware that Sustainable Systems Design, as discussed e.g. in Sects. 1.6 and 
5.1.1, requires a holistic approach, i.e. the extension of system boundaries to socio- 
technical systems. Therefore Fig.7.1 complements Figs. 1.10, 5.2 and 5.3. In short, 
sustainability can only be assessed from a combined socio-economic and technical 
perspective. Integration of these perspectives is essential for future research. 

(F) stakeholder management, combining stakeholder analysis and market regu- 
lation, named side by side with (A) product design is part of economics, sociology 
and law. The scientific methods in that field stem e.g. from cybernetics or applied 
mathematics. Game theory is one branch of applied mathematics being beneficially 
applied to stakeholder analysis [3]. 

(G) FAIR data management [2] is an enabler for transparency in quality key perfor- 
mance indicators (KPI) to foster acceptability. Hence, the quality dimensions (i) effort 
F measured in economic and social cost, (ii) availability F and (iii) acceptability F3 
need to be further developed as enablers for Corporate Social Responsibility (CSR). 
These objectives apply to data, software, but also to already existing conclusions. 
FAIR data management requires (i) data competence, (ii) information technologies 
and (iii) data governance and curation. Therefore, FAIR data management is the pre- 
requisite for the process from data to wisdom; it leads to a living digital twin being 
represented by a graph with persistently identified subjects and objects as nodes. The 
edges represent the predicate, i.e. functions mapping the data from the subject to the 
object. The graph in combination with a consistent ontology allows accessibility and 
reusability of the data. 

With regard to the interaction between the interest groups, the consumer market 
differs from the capital goods market in the actors involved. For the former, these are 
manufacturers, planners, owners/operators and society. In the case of infrastructure 
systems, the number of stakeholders is further increased because owner and operator 
are usually not identical and different infrastructure systems are usually coupled. 
This considerably increases the complexity of stakeholder interactions. In the case 
of consumer goods, the acting stakeholders are usually limited to manufacturers, 
retailers, digital matchmakers, customers and society. In both cases, with or without 
online platform markets, it is clear that emerging block-chain based digital currencies 
will change the interplay between markets and stakeholders. 

Components of production systems or fluid systems are traded on the capital 
goods market, a typical business to business market. The composed systems enable 
functions, such as producing, transport, heating, and many others. Mostly, these are 
typical infrastructure systems with (i) complex stakeholder interaction and market 
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regulations, (ii) frequently unclear functional requirements and quality KPI as well 
as (iii) an only beginning smart modularisation. 


7.2 Future of Mastering Uncertainty 


This book builds on the tradition of Taguchi’s robust design method, which has 
been used since the 1960s. At the same time, the world has continued to develop 
over the past 60 years, and the past 10 years in particular have seen significant new 
contributions to the mastering of uncertainty. Many of them are presented in this 
book, to name only some keywords: 


(i) Rigorous classification of uncertainty, 

(ii) extension of the system boundary towards socio-technical systems, 
(iii) validated methods for mastering data, model and structural uncertainty and 
(iv) active components serving mastering uncertainty in load-bearing systems. 


It took two decades for Taguchi’s methods to spread. The dissemination time of 
the presented newer concepts will be shorter for several reasons: First, the needs 
of society and the emergence of CSR are becoming powerful drivers for mastering 
uncertainty; second, digitalisation and computer power enable new methods, tech- 
nologies, and strategies for quantifying and mastering uncertainty as presented in 
this book. 

Our main focus has always been on mastering uncertainty. The three strategies to 
be most important in mastering uncertainty are 


(i) design and operate robustly, 
(ii) gain flexibility and 
(iii) enable resilience. 


There is still much to do for gaining robust, flexible, or resilient technical systems. 
In the following three sections, we anticipate the future regarding (i) to (iii). 


7.2.1 Robustness 


Section 6.1 illustrates that a wide range of methods and technologies is now available 
to master uncertainty through sufficient robustness. For both aspects, first uncertainty 
quantification, and second robust optimisation of components and systems, there is 
a need for multi-purpose, easy-to-use software frameworks. First and in more detail 
regarding uncertainty quantification: a software framework is needed supporting a 
consistent workflow from the quantification of uncertainty within the product design 
phase, to the propagation of uncertainty in the production phase and to the predic- 
tion of the system’s reliability in the usage phase. Within this framework, efficient 
probabilistic parameter calibration methods, e.g. in a Bayesian framework, shall 
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be available to cope with the increasingly complex and computationally intensive 
models used in the further virtualised product design. Second and regarding robust 
optimisation of components and systems: available mathematical methods are cur- 
rently not supported by general purpose software, and prior modelling based on 
human experience is needed before using it for practical problems. Both facts still 
inhibit Sustainable Systems Design. 

We expect software technologies to close this gap in the near future. Yet, there 
are still open research topics. The first addresses mathematical research, the second 
engineering research. Above all, the mathematical tools that enable robust optimisa- 
tion, as described in Chap. 6, all exploit the underlying structure of the problem in 
one way or the other. Extending these methods to systems for which the correspond- 
ing mathematical structure is different, lacks refined methods and therefore requires 
mathematical research. Thus, although robust optimisation has developed into a rel- 
atively mature field with many contributions, there are still many open research 
questions, in particular for problems of practical interest, such as dynamical, i.e. 
transient problems. 

As has been seen in Chaps. 1, 3 and 6, Robust Design and the related Sustainable 
Systems Design as it is understood here, can be seen as solving a constrained opti- 
misation problem with the specified systems function as one constraint to be solved 
for a given design space. The objective has three dimensions: effort, availability 
and acceptability. To master uncertainty in the customer expectation, in material 
or component properties, usually an increase of effort, e.g. regarding material con- 
sumption, is needed. Section 3.5 listed seven inherent Robust Design and operating 
concepts that potentially offer additional freedom of design without additional cost 
and weight. Thus, tailored material or component behaviour could be one promising 
approach with graded material or component stiffness. Also the deliberate use of 
residual stresses potentially offers additional freedom of design without additional 
cost and weight. 

When it comes to systems, the robustness of individual modules or components 
is strongly influenced by the behaviour of other components of the system. Thus, the 
application of Taguchi’s DoE method as one tool of the Robust Design methodology 
can become quite expensive. Therefore, a further important research area is the 
efficient and comprehensive validation of a module’s robustness under simulated 
realistically detuned operation and installation conditions. 

In contrast to resilience, robust systems do not show recovery phases. Hence, 
robustness is achieved mainly by “smart” decisions made in the (A) product design 
prior to the product life sequence B, C, D, E. In the future, merging of data gained 
from experiences made in the product usage or a physical or cyber-physical prod- 
uct validation test with prior knowledge will become much more important. This 
merge will result in grey-box models enabling the mentioned “smart” decisions. 
Indeed, there is a need for integrating Bayesian methods with Robust Design and 
risk assessment in product design. 
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7.2.2 Flexibility 


Section3.5 introduced the concept of flexibility and Sect.6.2 depicts promising 
approaches for mastering uncertainty by increased flexibility. At the same time, it 
also reveals the additional costs and complexity of design and production processes 
concomitant with higher flexibility. Further research work is necessary to provide 
either (i) smart modules or (ii) smart modularisation, cf. Sect. 3.5, which allows for 
the highest flexibility at a specific minimised cost. One promising approach for future 
developments could be the application of lean design engineering principles to obtain 
flexible systems. 

First, smart modularisation is an interesting application field for optimisation 
methods presented in this book. Second, smart modules usually incorporate semi- 
active or active components within complex technical systems. They offer a freedom 
in usage and by this cover different customer needs or expectations. However, the 
reliable mastering of uncertainty, e.g. by the methods presented within this book, 
is necessary to, on the one hand, legitimate the increased effort associated with the 
semi-active and active components and, on the other hand, increase the acceptability 
for the customer and within society. 

The current driver for modularisation is the speed when scaling up as well as satis- 
fying customer demands. Functional units are integrated into modular type packages 
fulfilling a functional requirement specification. Further open questions are auto- 
mated documentation as well as the approval processes. From a Sustainable Systems 
Design perspective, as defined here, it is clear that the specified function will be a 
constraint, whereas the minimisation of social costs measured in energy or material 
consumption will be an objective. This demands the definition of metrics and the 
aggregation of quality KPI from the component level up to the business level. Thus, 
commissioning, approval and learning will be enabled by FAIR data management as 
specified above. 


7.2.3 Resilience 


As discussed in Sect. 6.3, robust systems do not show a recovery phase after a severe 
impact, whereas resilient systems do. Besides seldom exceptions, only smart agents, 
humans or cyber-physical modules enable a recovery phase being characteristic for 
dynamically resilient systems. Those agents heal severely experienced damage by 
having the ability to measure, react, learn and anticipate. 

We can imagine that in a composed system, agents interact in such a way that 
each agent measures its surrounding and all agents together react in a self-organised 
manner. This vision can be seen as a biologicalisation of products and processes. The 
driving potential for the agents to act is the loss of functional quality, cf. Chap. 1. 
From this perspective, the recovery phase of the resilience triangle is a Continuous 
Improvement Process (CIP) of products or the product design phase. Only now, the 
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latter takes place within the usage phase. Hence, in this picture of dynamic resilience 
(A) product design becomes integrated into the product life sequence B, C, D, E 
mentioned above. 

There are few examples of self-healing materials, components or systems without 
cyber or real agents. In Sect.3.5, liquid sealant added to the inside of a tire was 
mentioned as one example: a puncture is self-healed by this sealant; a wooden boat 
seals itself by swelling the wood; a leather boot automatically seals small holes. In 
the named examples swelling is the basis for self-adaption or self-healing. In nature 
we observe stress-induced shape optimisation inline and online integrated in the life 
sequence B, C, D, E. Today, we use such shape optimisations offline in the (A) product 
design. Also here, the future task is to integrate (A) product design in the (C) usage 
phase as nature does. From this we conclude that the design of self-healing materials 
or self-repairing machines could be stimulated from nature. Their integration into 
technical systems could pave the way to the so far difficult to achieve recovery of 
structures. 

In Sect. 6.3, static resilience is distinct from dynamic resilience: static resilience 
is the property of a system predefined by the system’s design; dynamic resilience is 
the skill to react to a loss of functionality. The degree of static resilience e.g. of a 
water supply network is established in the (A) product design. The future will focus 
on the trade-off between static resilience and the costs achieving this static resilience. 
Our current research shows that there is a saturation of gained static resilience versus 
costs as one would expect. Still, there are open questions regarding the resilience of 
networks. 

Mathematical tools to optimally design resilient systems have been developed for 
a long time, often under different names like network survivability, etc. The corre- 
sponding problems are inherently multi-level and an exploitation of the particular 
structure is necessary in order to be able to solve the corresponding optimisation 
problems. Similar to robust optimisation, the future is likely to see a refinement and 
extension of the available tools and hopefully software support. Moreover, incorpo- 
rating learning into the systems poses interesting mathematical challenges. 


7.3 Final Remarks 


Our approach is mainly based on the creation of white-, grey- and black-box models 
and the use of those models for algorithmic supported systems design. The compo- 
sition takes place for a known design space. We fully acknowledge that uncertainty 
sometimes can also be mastered by out-of-the-box thinking, cf. Chap. 1, where 
out-of-the-box means outside the known design space. Improvisations leading to 
processes and designs not foreseen in the originally created design space can defi- 
nitely be stimulating and often help to create new break-through technologies and 
designs. 

Although this book is based on Ratio and Reason, Intuition and Inspiration are the 
most important drivers. In that respect we are in agreement with the British empiricist 
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David Hume and others, cf. Sect. 1.3. The systematic development of the necessary 
creativity could be an important topic for future engineering education. 
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Glossary 


Acceptability One of three dimensions of a system’s quality besides effort and 
availability. Formal acceptability is reached by conformity with explicit legal 
constraints or any implicit conventions; informal acceptability is fostered by func- 
tional quality and minimal social costs. 

Active system — system, active 

Actuator An energy converter generating potential influence on a process. 

Adaptive system — system, adaptive 

Aleatoric uncertainty — uncertainty, aleatoric 

Algorithm Finite sequence of (computer-)instructions to solve a problem. 

Anticipating Predictive process (and system) change with the aim of reducing 
uncertainty. Anticipating is one of four abilities/functions of a resilient system. 

availability One of three dimensions of a system’s quality besides effort and 
acceptability. Availability measures the relative usability of a technical system 
in time. 

Black-box model —> model, black-box 

Buffering capacity Metric for evaluating the resilience of a technical system. The 
buffering capacity of a technical system measures the amount of structural change 
for which the fulfilment of a predetermined required minimum of functional per- 
formance can still be guaranteed. Depending on the context, the buffering capac- 
ity can attain continuous or integer values. (Example: In case of integer values, it 
describes the maximum number of components that can fail while still maintain- 
ing the required minimum of functional performance.) A system has a buffering 
capacity of k if it guarantees the required minimum of functional performance 
within a predetermined range of influencing factors for all possible failure sce- 
narios of up to k components. 

Component Synonym for an assembly or single item. 

Conflict, data-induced A data-induced conflict exists when the interpretation and 
usage of uncertain data from more than one source leads to contradictory state- 
ments about the appropriate design of processes or products. 
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Constraint Requirement for the design and usage/operation of a socio-technical 
system. 

Data Generic term for a quantifiable system value. 

Data management Data shall be findable, accessible, interoperable, reusable 
(FAIR). As such, FAIR data management fosters transparency and hence accept- 
ability. It is the prerequisite for quality key performance indicators (quality KPI). 

Data uncertainty The nature of data uncertainty depends on the form in which data 
are available. If data are stochastically distributed, there is stochastic uncertainty. 
If they are known to be within limits, but not stochastically distributed, there 
is incertitude. Unnoticed or ignored uncertainty occurs when there is neither 
stochastic uncertainty nor incertitude. 

Data-induced conflict — conflict, data-induced 

Design Methodical procedure from the first idea through planning, conception and 
development to the virtual elaboration of a (load-bearing) product. 

Design point A technical system is designed for a specific design point. If the 
system designer strives for a robust design, considerations not only comprise one 
design point, but also an uncertainty area around it. 

Design space The function of a system can only be realised within a certain design 
space. The design space is limited by physical laws as well as by the available 
resources or resource materials, components and technologies. The design space 
can be expanded by innovations or restricted by banning technologies, e.g. by the 
requirement for carbon-free energy supply. Systems that enable the same function 
usually differ in quality. The task of Sustainable Systems Design is to select from 
these competing systems one with an optimal quality within the design space. 

Diagnosis A diagnosis is used to find the cause of disturbances. If a disturbance 
is not directly observable but only its effect on the system, only the symptoms 
of the disturbance can be observed. The diagnosis allows conclusions from these 
symptoms on the cause. In particular, it serves to find causes in data-induced 
conflicts. 

Disturbance A disturbance leads to unexpected, unauthorised deviations of at least 
one system value. This can lead to a malfunction or failure of the system. 

Effort One of three dimensions of a system’s quality besides acceptability and 
availability. Effort measures the investment costs and social costs given by energy 
and material consumption to achieve a desired system function. 

Epistemic uncertainty — uncertainty, epistemic 

Flexibility A flexible system is characterised by the fact that it fulfils multiple 
predefined functions with accepted functional quality. Flexibility is used as a 
strategy to master uncertainty during the product life cycle of technical systems. 

Function Desired relationship between a system’s input and output with the aim 
of fulfilling a task. 

Functional requirement Between stakeholders agreed and predefined function of 
a system. 

Gracefulness Metric for evaluating the resilience of a technical system. Its 
behaviour may be described as “graceful degradation” at the boundary of its 
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performance range towards the loss of the required minimum degree of the func- 
tional performance. Mathematically, it is defined by the directional derivative of 
the functional performance curve in the direction of a given influencing factor (or 
a vector of multiple influencing factors). In the case of non-differentiability, it is 
given by the limit from the direction of the design point. 

Grey-box model — model, grey-box 

Hardware-in-the-Loop Hardware-in-the-Loop (HiL) tests investigate the 
behaviour of real components connected to real-time simulated systems and allow 
the stepwise integration of a technical module or component into a real system 
by combining cyber world and real world. 

Ignorance Disregarded but relevant reality. The effect of uncertainty is unknown or 
only suspected. Ignorance is associated with model uncertainty and with ignored 
possible manifestations of a product, system or process. No statement can be made 
about the probability distributions of an unfolding uncertain property. 

Incertitude Limit values of an emerging uncertain product characteristic can be 
assumed. Furthermore, no probability distributions have to be presumed. There 
are known or estimated membership functions in fuzzy analysis or intervals in 
interval analysis. The variability is uncertain. 

Information Information is derived from the interpretation of data and serves as 
the basis for decisions. Interpretation may be performed within models. 

Irrelevant reality — reality, irrelevant 

Learning Reduction of model uncertainty and data uncertainty through permanent 
model identification and model adaptation during the product life cycle. Learning 
is one of four abilities/functions of a resilient system. 

Margin Metric for evaluating the resilience of a technical system. The margin of 
a technical system is the distance of the actual functional performance to the 
system’s required minimum of functional performance. 

Model Abstract image of an object in form of a mathematical model or other, such 
as imaginary on the basis of intuition. A mathematical model is substantiated in 
axiomatic (white-box model) or empirical (black-box model) terms or both (grey- 
box model). Mathematical models represent a functional relationship between 
input and output data, model parameters and internal variables, like states. 

Model, black-box Model derived from measurements of a process or the experi- 
ence of a user. In the first case, these models are called data-driven models today. 
In the second case, the deposited model is part of an expert system. 

Model, grey-box Model that combines axiomatic and empirically derived relation- 
ships as well as (expert) user experience. 

Model, white-box Model derived by deduction from axioms. Model uncertainty 
in white-box models arises from an impermissible model structure or impermis- 
sible simplifications, e.g. an assumption of quasi-stationary system behaviour, 
inadmissible constitutive equations as well as inadmissible initial and boundary 
conditions. 

Model horizon Boundary of the relevant reality represented by the model. 

Model uncertainty Model uncertainty arises from an incomplete mapping of the 
object. Parts of the relevant reality are ignored. In the case of model uncer- 
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tainty, the functional relationship is suspected, unknown, incomplete or ignored— 
ignorance prevails in all cases. 

Module  Function-oriented group of components of a technical entity or algorithm; 
each with clear interfaces. 

Monitoring Sensing a process by means of data acquisition and data analysis via 
models to obtain information. Monitoring is the one of four abilities/functions of 
a resilient system. 

Object Generic term for product, system or process. 

Objective Target for the design and usage/operation of a socio-technical system. 

Operator An operator provides an effective quantity to be able to carry out a 
process. The effective quantity is the purpose of the operator and thus causes 
the desired change of state. In production, for example, the operator comprises 
machines and the necessary auxiliary material for the production process of the 
load-bearing structure. In the process of usage, however, the operator refers, for 
example, to the used load-bearing system. 

Parameter (model) Model parameters are brought into a functional relationship in 
amodel. They are a data component. Model parameters are derived from empirical 
data, literature or model analysis. 

Passive system — system, passive 

Performance range Basis for assessing the resilience of a technical system. The 
performance range describes the range of influencing factors in which a technical 
system is able to achieve a predefined required minimum functional performance. 
The performance range can be mathematically expressed by the so-called “super- 
level set” of the functional performance curve at the level of the required minimum 
functional performance. 

Process A process transforms a primary state into a final state. The process is 
associated with an individual process or a process chain. 

Process, time-invariant A process started at a time always shows the same 
behaviour. It can start at any time without a change of result. The parameters of 
its mathematical description and transfer functions of a controller are for example 
invariable in time (invariant). 

Process, time-variant A process started at a time shows different behaviour over 
time, see time-invariant process. 

Process chain A process chain is the combination of individual processes. They 
transform a primary state into a final state, with the operand going through various 
intermediate states. Process chains can be modelled across life cycle phases. A 
process chain can also be used to represent a component structure. 

Process chain, resilient Inaresilient process chain, monitoring, responding, learn- 
ing and anticipating internal and external disturbances (for example machine 
failure, manufacturing uncertainty, slump in demand, and uncertainty in product 
usage) can be used to address ignorance. 

Process model Common and applicable mode of communication for the various 
areas of expertise to define a process chain incorporating systematically and trans- 
parently the individual processes and the resulting uncertainty. 
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Product A product is an object that did not originate naturally, but is produced 
by man himself for other people, and that is used or consumed in the context of 
purpose-oriented action in usage processes. 

Product life cycle The product life cycle describes the process chain: sourcing, 
production, usage and reuse/recycling. 

Product properties Properties of products or systems are divided into function and 
quality. 

Production The process of making products, components or systems. 

Quality Measures—in the tradition of Taguchi—the effort with which a function 
is achieved. The effort is measured in economic and social costs. In addition, there 
is the availability and the acceptability. 

Radius of performance Metric for evaluating the resilience of a technical system. 
It is connected to the technical system’s performance range. The radius of perfor- 
mance measures the minimum distance of the design point to the specific value 
of an influencing variable for which the required minimum level of functional 
performance is no longer reached. 

Reality, irrelevant The part of reality that is not necessary to answer a question. 

Reality, relevant The part of reality necessary to answer a question. 

Reliability The feature of a product to not fail with a certain probability under 
stated functional and environmental conditions during a specified period of time. 

Resilient process chain — process chain, resilient 

Resilient system — system, resilient 

Responding Process intervention based on information with the aim of reducing 
uncertainty. Responding is one of four abilities/functions of a resilient system. 

Risk analysis Specific operational measures to deal with uncertainty at the real pro- 
cess and product level. Risk analysis is limited to the identification and description 
of risks. The definition and application of specific measures are covered by risk 
management. 

Robust Design Robust Design is an engineering design methodology also known 
as Taguchi methods. In Robust Design (i) uncertainty is replaced by stochas- 
tic uncertainty using the concept of quality loss functions; (ii) sourcing, design 
and production phases are hollistically treated by the concept of off-line quality 
control. The basis of off-line quality control is firstly the Design of Experiments 
(DoE) and secondly the robust optimisation in the so-called parameter design. 
Taguchi developed the methodology based on previous works of Ronald Fisher 
on DoE. In modern Robust Design the concept of perceived quality, i.e. customer 
experience, and social costs as quality measures are already anticipated. 

Robust optimisation A product is designed and optimised in such a way that, even 
with unavoidable influence of disturbances and variations of input variables within 
the model horizon, the user expectations are completely fulfilled. 

Robustness A robust system proves to be insensitive or only insignificantly sen- 
sitive to deviations in system properties or varying usage. Robustness is used as 
a strategy to master uncertainty from the different perspectives of mathematical 
optimisation, product or system design and production. 

Semi-active system — system, semi-active 
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Socio-technical system In contrast to technical systems or techno-economic sys- 
tems that only include technical components and their interaction regarding the 
flux of energy, material or information including money, socio-technical systems 
take into account the human being and the technical components. The effects of 
the interaction of humans and technology play a decisive role in the analysis of 
socio-technical systems. 

Soft sensor Model-based acquisition of information at the component and/or sys- 
tem level. The target value is not measured directly, but determined based on a 
model. As such, soft sensors are familiar with state observers and Kalman filters 
based on Bayesian methods. 

State variable The state variables, according to the state space representation of 
system theory, describe the current state of a system, regardless of its origin, e.g. 
force, speed, etc. 

Stochastic uncertainty — uncertainty, stochastic 

Structural uncertainty Only a part of all possible structures of the design space is 
evaluated, i.e. the remaining part of the design space is ignored. 

Structure Combination of functions (functional structure), components (compo- 
nent structure) or process chains to fulfil a function. 

Sustainable Systems Design Engineering design methodology representing the 
design process as a constraint optimisation process: functional requirements and 
design space form the constraints, quality dimensions give the objectives. The 
three quality dimensions are minimal effort, maximal availability and maximal 
acceptability. 

System The system describes the totality of all elements considered. Setting a sys- 
tem boundary defines the object or product, respectively, the objects or products. 

System, active An active system is characterised by the supply of external energy 
to influence a process. The external energy always influences the process via the 
operator. The term external energy does not include energy that is available to 
fundamentally necessary operations within the process, in particular no supply 
energy. 

System, adaptive A technical system that can be adjusted to the particularities of 
various situations, due to its technical characteristics. Adaptivity is the prerequisite 
for a resilient system. 

System, passive A passive system is characterised by the fact that external energy 
is only provided for the processes that are fundamentally necessary in the process, 
i.e. in particular as supply energy. 

System, resilient A resilient technical system guarantees a predetermined mini- 
mum of functional performance even in the event of disturbances or failure of 
system components and a subsequent possibility of recovering at least the setpoint 
function. Resilience can be increased by adjusting the system state via monitoring, 
responding, learning and/or anticipating, as well as by systematically designing 
the system topology. 

System, semi-active A semi-active system is characterised by the supply of external 
energy to influence the operator. In this case, any properties of the operator can be 
influenced by the external energy. The process itself is only affected indirectly by 
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the external energy. The term external energy does not include any energy that is 
available to fundamentally necessary operations within the process, in particular 
no supply energy. 

Techno-economic system In contrast to technical systems that only include techni- 
cal components and their interaction, techno-economic systems take into account 
the flux of money and economic measures such as profit. 

Time-invariant process — process, time-invariant 

Time-variant process — process, time-variant 

Uncertainty Uncertainty occurs when the usage properties and process character- 
istics of a system cannot, or can only be partially determined. 

Uncertainty, aleatoric Natural, random and irreducible uncertainty. 

Uncertainty, epistemic Uncertainty due to incomplete scientific knowledge. Epis- 
temic uncertainty can be reduced by new insights. 

Uncertainty, stochastic Partial to complete details on probability distributions of 
an emerging uncertain product characteristic are available. There are known or 
estimated probability density functions; the variability is always determined. 

Usage Usage or operation of a component, product, system or process. 

Validation Analysis to what extent a model after calibration is suitable for the 
description of a relevant functional relationship by comparison of reality and 
model. Furthermore, evaluation to what extent a product meets the predefined 
quality and functional constraints and to what extent a product is accepted by the 
customer and the society. 

Verification Review whether the model is consistent and has been correctly solved. 
Furthermore, evaluation to what extent the design and production methods and 
technologies are selected correctly. 

Vulnerability A system’s vulnerability or violability. 

White-box model > model, white-box 


